CVE Intelligence
Analysis AI-assisted

CVE-2026-54825: wpDataTables Unauthenticated SQL Injection

An unauthenticated SQL injection flaw (CWE-89) affects wpDataTables 7.4 and earlier, as described in the record. The CNA Patchstack scored it 9.3 (critical) under CVSS 3.1. The record lists no fixed version and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A critical SQL injection vulnerability (CWE-89) has been published for the wpDataTables WordPress plugin. According to the record, it can be triggered without authentication in version 7.4 and earlier. The CVE was published by Patchstack acting as CNA.

Impact

  • The CVSS 3.1 base score recorded by the CNA is 9.3, with network attack vector, low complexity, no privileges and no user interaction required.
  • The vector records high confidentiality impact, no integrity impact and low availability impact, with a changed scope.
  • SQL injection can expose database contents. The exact data reachable depends on the vulnerable code path, which the record does not detail.

Affected products and versions

  • The record describes wpDataTables versions 7.4 and earlier.
  • The structured affected and fixed lists in the record are empty. Confirm the exact affected range with the Patchstack entry and the vendor before drawing conclusions.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.004 with a percentile of 0.32419, which is a low predicted likelihood of exploitation in the near term.

Remediation and mitigation

  • The record does not list a fixed version. Check the Patchstack entry and vendor release notes for a corrected release before deciding on an upgrade path.
  • Plan to update wpDataTables to a release that the vendor confirms as fixed, and test the update in a staging environment first.
  • While a fix is pending, reduce exposure: disable the plugin if it is not needed, restrict access to its functions where feasible, and apply web application firewall protections from a trusted provider.
  • Apply least-privilege rules to the database account used by the website and keep verified backups.

Detection guidance

  • Review web server and application logs for unusual or malformed parameters sent to wpDataTables features.
  • Look for database error messages or unexpected query behaviour reported by the application.
  • Watch for unexpected changes to administrator accounts, content or plugin files.

Limitations of the available information

  • The record has no structured affected or fixed version data and no vendor-specific technical details.
  • The record title is missing and the source status is marked as Deferred.
  • The affected endpoints, required conditions and exact impact on data are not described in the consulted sources.

Frequently asked questions

Is a fixed version listed for this CVE?

No. The record does not list a fixed version, so check the Patchstack entry and vendor release notes before deciding on an upgrade.

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.