CVE-2021-24198: wpDataTables < 3.4.2 - Improper Access Control leading to Table Data Deletion
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through idkey and idval parameters. By exploiting this issue an attacker is able to delete the data of all users in the same table.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24198?
CVE-2021-24198 has a medium severity rating due to improper access control that allows low privilege users to delete data from tables.
How do I fix CVE-2021-24198?
To resolve CVE-2021-24198, update the wpDataTables plugin to version 3.4.2 or later as this version addresses the access control issue.
What version of wpDataTables is affected by CVE-2021-24198?
CVE-2021-24198 affects wpDataTables versions before 3.4.2.
What kind of attack is possible due to CVE-2021-24198?
CVE-2021-24198 allows an authenticated low privilege user to manipulate table parameters and potentially delete data belonging to other users.
Where can I find more information about CVE-2021-24198?
More information about CVE-2021-24198 can typically be found in the official changelogs or security advisories related to the wpDataTables plugin.