Unauthenticated SQL Injection Vulnerability in wpDataTables Plugin Affects Premium Users
CVE-2024-3820
10CRITICAL
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 1 June 2024
What is CVE-2024-3820?
The wpDataTables Plugin for WordPress is prone to SQL Injection vulnerabilities via the 'id_key' parameter associated with the wdt_delete_table_row AJAX action. This flaw arises from inadequate escaping of user-supplied data and insufficient preparation of SQL queries. As a result, unauthenticated attackers can manipulate existing SQL commands, potentially gaining unauthorized access to sensitive information stored in the database. This vulnerability impacts the premium version of the plugin and poses significant risks for website owners utilizing this feature.
Affected Version(s)
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin * <= 6.3.1