High severity · published Apr 12, 2021
CVE-2021-24197
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control
8.1
CVSS
1.2%
EPSS
No
On KEV
Description
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to access the data of another user that are present in the same table by taking over the user permissions on the table through formdata[wdt_ID] parameter. By exploiting this issue an attacker is able to access and manage the data of all users in the same table.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Wpdatatables · Tms-outsource
before 3.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24197
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24197
Third Party Advisory
https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/
Release Notes
https://wpdatatables.com/help/whats-new-changelog/
Third Party Advisory
https://wpscan.com/vulnerability/a56c04a4-dda0-4a7f-a525-d0349a1fda2b
More from Wpdatatables
8.1
CVE-2021-24198
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control
7.2
CVE-2023-4314
wpDataTables < 2.1.66 - Admin+ PHP Object Injection
6.5
CVE-2021-24200
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table…
6.5
CVE-2021-24199
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table…
6.1
CVE-2024-0591
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting.