What is the CVSS score of CVE-2026-28039?

CVE-2026-28039 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of wpDataTables are affected by CVE-2026-28039?

wpDataTables plugin for WordPress versions up to 6.5.0.1 contains a local file inclusion vulnerability that allows authenticated users with low privilege to read sensitive server files, including…

How to fix or mitigate CVE-2026-28039?

Within 24 hours: Identify all WordPress instances running wpDataTables and document current versions; audit access logs for suspicious file-read patterns. Within 7 days: Disable or uninstall wpDataTables if not actively required; if required, restrict plugin access to administrator accounts only and implement network-level file access controls. Within 30 days: Monitor Patchstack and vendor advisories for available patch to wpDataTables; plan upgrade to patched version when released, and conduct password rotation for all database and API credentials stored on affected servers.

wpDataTables CVE-2026-28039

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:05 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpDataTables wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through <= 6.5.0.1.

AnalysisAI

Local file inclusion in wpDataTables plugin for WordPress (versions up to 6.5.0.1) enables authenticated attackers to read arbitrary files from the web server filesystem with high complexity conditions. An attacker with low-privilege access can include PHP files or extract sensitive configuration data (database credentials, API keys) from readable server files. EPSS score of 0.13% (32nd percentile) indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis. Patchstack researchers disclosed this as a PHP local file inclusion weakness (CWE-98) exploitable over the network.

Technical ContextAI

This vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement), a classic PHP file inclusion weakness where user-controlled input influences file path arguments to include(), require(), or similar PHP functions without adequate sanitization. In wpDataTables, a WordPress plugin for creating tables and charts from database data, the flaw allows manipulation of file paths during PHP include operations. Unlike remote file inclusion (RFI) which fetches external URLs, this local file inclusion (LFI) vulnerability reads files already present on the server. The CVSS vector AC:H (high attack complexity) suggests exploitation requires specific conditions such as particular plugin settings, predictable file paths, or chaining with directory traversal techniques (../ sequences). The vulnerability affects wpDataTables versions through 6.5.0.1, suggesting a longstanding code defect in file handling routines within the plugin's PHP codebase.

Affected ProductsAI

WordPress wpDataTables plugin versions from the earliest release through version 6.5.0.1 are confirmed vulnerable per Patchstack advisory. The plugin is maintained by wpDataTables and available through the WordPress plugin repository. Affected deployments include any WordPress installation running wpDataTables 6.5.0.1 or earlier where authenticated users (even low-privilege roles like subscribers or contributors) have access to plugin functionality. The Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-4-0-5-local-file-inclusion-vulnerability?_s_id=cve provides vulnerability details, though the URL references version 6.4.0.5 while the CVE scope extends to 6.5.0.1, suggesting multiple vulnerable releases.

RemediationAI

Upgrade wpDataTables plugin to version 6.5.0.2 or later if available, as the CVE scope ending at 6.5.0.1 indicates a subsequent release contains the fix. Check the WordPress plugin dashboard for updates or manually download from the official WordPress plugin repository. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-4-0-5-local-file-inclusion-vulnerability?_s_id=cve for vendor-confirmed fix version and implementation details. If immediate patching is impossible, implement compensating controls: restrict wpDataTables plugin access to administrator roles only through WordPress role management (Users → Roles), reducing the PR:L attack surface to PR:H; apply Web Application Firewall (WAF) rules to block requests containing directory traversal patterns (../, %2e%2e%2f, encoded variants) in parameters processed by wpDataTables, though this may interfere with legitimate table configuration features; audit WordPress user accounts to remove unnecessary low-privilege credentials; monitor server access logs for suspicious file read attempts targeting sensitive paths like wp-config.php or /etc/passwd. Note that role restriction significantly increases attack complexity but does not eliminate risk from compromised administrator accounts.