The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wpdatatables Plugin | — | Update wpdatatables plugin to version 3.4.2, or a newer patched version | May 15, 2025 | Mar 16, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub