What is the CVSS score of CVE-2026-49080?

CVE-2026-49080 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of wpDataTables are affected by CVE-2026-49080?

wpDataTables WordPress plugin (versions 7.3.6 and earlier) contains a critical SQL injection vulnerability allowing unauthenticated attackers to extract credentials and PII directly from WordPress…

How to fix or mitigate CVE-2026-49080?

Within 24 hours: Inventory all WordPress installations to identify systems running wpDataTables and document current versions in use. Within 7 days: Either deactivate and remove the plugin or deploy Web Application Firewall rules blocking SQL injection patterns to the plugin's API endpoints, combined with database-level access controls and query logging. Within 30 days: Apply vendor-released patch once available (monitor WordPress.org plugin repository and Patchstack advisory); conduct forensic review of database access logs for exploitation indicators dating back to plugin installation.

wpDataTables CVE-2026-49080

EUVD-2026-37496 CRITICAL

SQL Injection (CWE-89)

2026-06-16 Patchstack

WordPress SQLi Wpdatatables Wordpress Plugin Tms

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); scope changes to the WordPress DB (S:C); read-oriented data exposure drives C:H, no integrity change, minor A:L from query load.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:25 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

AnalysisAI

SQL injection in the wpDataTables WordPress plugin versions 7.3.6 and earlier allows unauthenticated remote attackers to inject crafted SQL into backend database queries, with CVSS 9.3 reflecting a scope-changed impact that reaches beyond the plugin's own data context. The CVSS vector indicates high confidentiality impact and low availability impact with no integrity impact, suggesting the flaw is primarily useful for extracting sensitive WordPress data (including credentials and PII) rather than tampering with records. No public exploit identified at time of analysis, but Patchstack's disclosure and the unauthenticated network attack vector make this a high-priority issue for any site running the plugin.

Technical ContextAI

wpDataTables is a popular commercial WordPress plugin by TMS Plugins (CPE cpe:2.3:a:tms:wpdatatables) used to build interactive tables, charts, and dashboards backed by SQL queries against the WordPress database or external MySQL sources. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-controllable input - likely a table identifier, filter, sort, or search parameter exposed via a public-facing AJAX or REST endpoint - is concatenated into a SQL statement without proper parameterization or escaping. Because wpDataTables routinely queries the WordPress core database to render front-end tables, an injection point gives an attacker direct read access to wp_users (password hashes, emails), wp_options (secrets, API keys), and any custom tables the plugin is configured to expose.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed from the provided data - administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-7-3-6-sql-injection-vulnerability) and the TMS Plugins changelog to identify and install the first version above 7.3.6 that contains the fix. Until upgrade is verified, compensating controls include placing a WAF rule (Wordfence, Patchstack mitigation, or ModSecurity OWASP CRS rules 942xxx) in front of wpDataTables AJAX endpoints to block SQL meta-characters in table, filter, and sort parameters - trade-off is potential false positives on legitimate table filter strings containing quotes. Alternatively, deactivate the wpDataTables plugin entirely, which removes the attack surface but breaks any front-end tables/charts it renders. As a defense-in-depth measure, restrict the database user used by WordPress to the minimum privileges needed (no FILE, no SUPER) so that a successful injection cannot escalate to file write or stacked-query abuse.