CVEvulnerability
CVE-2021-24198
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-04-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
- Weaknesses
- CWE-284
Description
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through id_key and id_val parameters. By exploiting this issue an attacker is able to delete the data of all users in the same table.
Affected configurations
• tms-outsource wpdatatables (< 3.4.2)
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/ Third Party Advisory
- https://wpdatatables.com/help/whats-new-changelog/ Release Notes, Vendor Advisory
- https://wpscan.com/vulnerability/d953bc62-8a6f-445b-a556-bc25cdd200e3 Third Party Advisory
- https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/ Third Party Advisory
- https://wpdatatables.com/help/whats-new-changelog/ Release Notes, Vendor Advisory
- https://wpscan.com/vulnerability/d953bc62-8a6f-445b-a556-bc25cdd200e3 Third Party Advisory