CVE-2014-9175 wpDataTables (Premium) <= 1.5.3 - SQL Injection
HighCVSS 7.5
EPSS 4.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the table_id parameter in a get_wdtable action to wp-admin/admin-ajax.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpDataTables | <= 1.5.3 | No fix listed |
| wordpress wpdatatables(WordPress) | < 1.5.4 | 1.5.4 |
References
- packetstormsecurity.com exploit
- 35340 exploit
- www.homelab.it exploit
- 71271 exploit vdb-entry
- wp-wpdatatables-sql-injection(98928) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org