What’s Vulnerable › Vulnerabilities

CVE-2021-26754

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-02-08 · updated 2026-06-17
• Weakness: CWE-89

Description

wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.

Affected products

• Wpdatatables: before 3.4.1 — fixed in 3.4.1

How to fix

Upgrade to a fixed version: Wpdatatables 3.4.1. Check the vendor advisory for mitigations.

References

• https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-i/
• https://wordpress.org/plugins/wpdatatables/#developers
• https://wpdatatables.com/help/whats-new-changelog/
• https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-i/
• https://wordpress.org/plugins/wpdatatables/#developers
• https://wpdatatables.com/help/whats-new-changelog/

Get alerted when CVE-2021-26754 or the next vulnerability affects your stack