CVE-2021-24200: wpDataTables < 3.4.2 - Blind SQL Injection via length Parameter
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=getwdtable&tableid=1, on the 'length' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24200?
CVE-2021-24200 has been assigned a moderate severity rating due to potential SQL injection vulnerabilities that could be exploited by low privilege authenticated users.
How do I fix CVE-2021-24200?
To fix CVE-2021-24200, update the wpDataTables plugin to version 3.4.2 or later.
Who is affected by CVE-2021-24200?
CVE-2021-24200 affects users of the wpDataTables premium WordPress plugin versions prior to 3.4.2.
What type of attack is associated with CVE-2021-24200?
CVE-2021-24200 is associated with Boolean-based blind SQL Injection attacks.
Where can I find more information about CVE-2021-24200?
More information about CVE-2021-24200 can typically be found in security advisories or vulnerability databases.