CVEvulnerability
CVE-2021-24197
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-04-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-284
Description
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to access the data of another user that are present in the same table by taking over the user permissions on the table through formdata[wdt_ID] parameter. By exploiting this issue an attacker is able to access and manage the data of all users in the same table.
Affected configurations
• tms-outsource wpdatatables (< 3.4.2)
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/ Third Party Advisory
- https://wpdatatables.com/help/whats-new-changelog/ Release Notes, Vendor Advisory
- https://wpscan.com/vulnerability/a56c04a4-dda0-4a7f-a525-d0349a1fda2b Third Party Advisory
- https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/ Third Party Advisory
- https://wpdatatables.com/help/whats-new-changelog/ Release Notes, Vendor Advisory
- https://wpscan.com/vulnerability/a56c04a4-dda0-4a7f-a525-d0349a1fda2b Third Party Advisory