CVE Database /
CVE-2021-24199
CVE · Medium
CVE-2021-24199 — wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24199
|
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.2 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Medium
6.5
|
< 3.4.2
|
3.4.2 |
2021-03-16 |
—
|
CVE-2021-24199
The wpDataTables plugin in versions before 3.4.2 contains a Boolean-based blind SQL injection vulnerability that can be exploited by authenticated users with low privileges. An attacker can inject malicious SQL code through the 'start' POST parameter on the /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1 endpoint to extract sensitive database information and potentially compromise the WordPress installation. This vulnerability is specific to the premium version of the plugin, despite it sharing the same plugin identifier as the free version.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings