CVE-2024-3820

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to SQL Injection via the 'id_key' parameter of the wdt_delete_table_row AJAX action in all versions up to, and including, 6.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Please note this only affects the premium version of the plugin.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-382006.5Microsoft Office Spoofing Vulnerability CVE-2024-382017.0Azure Stack Hub Elevation of Privilege Vulnerability CVE-2024-382027.3Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with CVE-2024-382035.5Windows Package Library Manager Information Disclosure Vulnerability CVE-2024-382046.5Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network.CVE-2024-382066.5An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information CVE-2024-382076.3Microsoft Edge (HTML-based) Memory Corruption Vulnerability CVE-2024-382086.1Microsoft Edge for Android Spoofing Vulnerability CVE-2024-382097.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability CVE-2024-38217.3The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to unauthorized access due CVE-2024-382107.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability CVE-2024-382118.2Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability