rtMedia for WordPress, BuddyPress and bbPress - XML injection (XXE)

 716 | /**
 717 | * @param string $XMLstring
 718 | *
 719 | * @return array|false
 720 | */
 721 | public static function XML2array($XMLstring) {
 722 | if (function_exists('simplexml_load_string') && function_exists('libxml_disable_entity_loader')) {
 723 | // http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html
 724 | // https://core.trac.wordpress.org/changeset/29378
 725 | $loader = libxml_disable_entity_loader(true);
>  726 |    $XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', LIBXML_NOENT);
   727 |    $return = self::SimpleXMLelement2array($XMLobject);
   728 |    libxml_disable_entity_loader($loader);
   729 |    return $return;
   730 |   }
   731 |   return false;
   732 |  }
   733 |
   734 |  /**
   735 |  * @param SimpleXMLElement|array|mixed $XMLobject
   736 |  *
       ^ Col 0