CVE Database /
CVE-2026-28039
CVE · High
CVE-2026-28039 — wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 6.5.0.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-28039
|
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 6.5.0.2 |
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') |
High
7.5
|
< 6.5.0.2
|
6.5.0.2 |
2026-03-03 |
—
|
CVE-2026-28039
The wpDataTables Premium plugin for WordPress contains a security flaw that enables unverified users to inject arbitrary server-side files into the application's processing stream. This vulnerability affects versions 6.5.0.1 and earlier, allowing malicious actors to execute any PHP code within those injected files. The potential consequences include unauthorized access to sensitive data or execution of malicious code.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings