What is the CVSS score of CVE-2026-49080?

CVE-2026-49080 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of wpDataTables are affected by CVE-2026-49080?

wpDataTables WordPress plugin (versions 7.3.6 and earlier) contains a critical SQL injection vulnerability allowing unauthenticated attackers to extract credentials and PII directly from WordPress…

How to fix or mitigate CVE-2026-49080?

Within 24 hours: Inventory all WordPress installations to identify systems running wpDataTables and document current versions in use. Within 7 days: Either deactivate and remove the plugin or deploy Web Application Firewall rules blocking SQL injection patterns to the plugin's API endpoints, combined with database-level access controls and query logging. Within 30 days: Apply vendor-released patch once available (monitor WordPress.org plugin repository and Patchstack advisory); conduct forensic review of database access logs for exploitation indicators dating back to plugin installation.

wpDataTables CVE-2026-49080

EUVD-2026-37496 CRITICAL

SQL Injection (CWE-89)

2026-06-16 Patchstack

SQLi Wpdatatables

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); scope changes to the WordPress DB (S:C); read-oriented data exposure drives C:H, no integrity change, minor A:L from query load.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:25 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

AnalysisAI

SQL injection in the wpDataTables WordPress plugin versions 7.3.6 and earlier allows unauthenticated remote attackers to inject crafted SQL into backend database queries, with CVSS 9.3 reflecting a scope-changed impact that reaches beyond the plugin's own data context. The CVSS vector indicates high confidentiality impact and low availability impact with no integrity impact, suggesting the flaw is primarily useful for extracting sensitive WordPress data (including credentials and PII) rather than tampering with records. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Fingerprint WordPress site running wpDataTables

Delivery

Identify vulnerable AJAX/REST endpoint

Exploit

Inject SQL via table/filter parameter

Execution

Enumerate schema via UNION or blind techniques

Persist

Exfiltrate wp_users hashes and secrets

Impact

Crack hashes and authenticate as admin

Access

Fingerprint WordPress site running wpDataTables

Delivery

Identify vulnerable AJAX/REST endpoint

Exploit

Inject SQL via table/filter parameter

Execution

Enumerate schema via UNION or blind techniques

Persist

Exfiltrate wp_users hashes and secrets

Impact

Crack hashes and authenticate as admin

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site with the wpDataTables plugin installed at version 7.3.6 or below, per CVSS AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All available signals point to genuine high priority: CVSS 9.3 with AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated, low-complexity attack with no user interaction, and the S:C (scope change) reflects database access crossing the plugin's authorization boundary into broader WordPress data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker locates a public WordPress site running wpDataTables ≤ 7.3.6 (fingerprintable via /wp-content/plugins/wpdatatables/ asset paths) and sends a crafted HTTP request to a vulnerable AJAX/REST endpoint with a SQL payload in a table, filter, or sort parameter. They use UNION-based or time-based blind injection to enumerate wp_users and dump administrator password hashes and email addresses, then crack the hashes offline or pivot to wp_options to steal API keys and integration secrets. …
Remediation	Upstream fix available (PR/commit); released patched version not independently confirmed from the provided data - administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-7-3-6-sql-injection-vulnerability) and the TMS Plugins changelog to identify and install the first version above 7.3.6 that contains the fix. … Detailed patch versions, workarounds, and compensating controls in full report.