CVE Database /
CVE-2021-26754
CVE · Critical
CVE-2021-26754 — wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-26754
|
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.1 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Critical
9.8
|
< 3.4.1
|
3.4.1 |
2021-02-02 |
—
|
CVE-2021-26754
The wpDataTables plugin versions prior to 3.4.1 contain a SQL injection vulnerability in the order parameter of table search functionality. By default, tables can be published on pages without requiring user authentication, allowing an unauthenticated attacker to exploit the order[0][dir] parameter and execute arbitrary SQL queries. This vulnerability affects both the premium and free versions of the plugin despite their shared slug identifier.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings