High severity · published Apr 12, 2021
CVE-2021-24198
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control
8.1
CVSS
1.5%
EPSS
No
On KEV
Description
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through id_key and id_val parameters. By exploiting this issue an attacker is able to delete the data of all users in the same table.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Wpdatatables · Tms-outsource
before 3.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24198
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24198
Third Party Advisory
https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/
Release Notes
https://wpdatatables.com/help/whats-new-changelog/
Third Party Advisory
https://wpscan.com/vulnerability/d953bc62-8a6f-445b-a556-bc25cdd200e3
More from Wpdatatables
8.1
CVE-2021-24197
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control
7.2
CVE-2023-4314
wpDataTables < 2.1.66 - Admin+ PHP Object Injection
6.5
CVE-2021-24200
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table…
6.5
CVE-2021-24199
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table…
6.1
CVE-2024-0591
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting.