TI-2024-03565 Aliases CVE-2024-3821 GHSA-3f72-vxqc-2p62

wpDataTables - Tables & Table Charts (Premium) <= 6.3.2 - Missing Authorization to DataTable Access & Modification

LOW 32CWE-862Published 2024-06-01 · Updated 2026-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the wdt_ajax_actions.php file in all versions up to, and including, 6.3.2. This makes it possible for unauthenticated attackers to manipulate data tables. Please note this only affects the premium version of the plugin.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00325 25th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
wpDataTables	wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin	up to 6.3.2	—	No fix listed	CNA

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin VendorwpDataTables Affected up to 6.3.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-3821
2026-10-03 Alias added: GHSA-3f72-vxqc-2p62

References

Other 2

TI-2024-03564 wpDataTables - Tables & Table Charts (Premium) <= 6.3.1 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 10.0
TI-2021-08425 wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka… CVSS 3.1CRITICAL 9.8
TI-2026-39628 WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
TI-2014-07443 SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and… CVSS 2.0HIGH 7.5
TI-2021-06490 wpDataTables < 3.4.2 - Improper Access Control leading to Table Data Deletion CVSS 3.1HIGH 8.1
TI-2021-06489 wpDataTables < 3.4.2 - Improper Access Control leading to Table Permission Takeover CVSS 3.1HIGH 8.1

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences