CVE-2021-24200CWE-89

wpDataTables < 3.4.2 - Blind SQL Injection via length Parameter

published April 12, 2021

CVSS
—
EPSS
1%
Percentile
71.1
In the wild
Unconfirmed
What it is

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'length' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01341 · 71.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-04-12T13:59Z
EPSS history
Timeline
  • 12 APR 13:59Z
    wpDataTables < 3.4.2 - Blind SQL Injection via length Parameter
    cvelistv5