Unauthenticated SQL Injection Vulnerability in wpDataTables Plugin Affects Premium Users
CVE-2024-3820

10CRITICAL

Key Information:

Vendor
Wordpress
Status
WPdatatables – WordPress Data Table, Dynamic Tables & Table Charts Plugin
Vendor
CVE Published:
1 June 2024

Summary

The wpDataTables Plugin for WordPress is prone to SQL Injection vulnerabilities via the 'id_key' parameter associated with the wdt_delete_table_row AJAX action. This flaw arises from inadequate escaping of user-supplied data and insufficient preparation of SQL queries. As a result, unauthenticated attackers can manipulate existing SQL commands, potentially gaining unauthorized access to sensitive information stored in the database. This vulnerability impacts the premium version of the plugin and poses significant risks for website owners utilizing this feature.

Affected Version(s)

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin * <= 6.3.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wpdatatables.com/help/whats-new-changelog/

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Villu Orav
.