What is the CVSS score of CVE-2026-54825?

CVE-2026-54825 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of wpDataTables are affected by CVE-2026-54825?

wpDataTables plugin (versions 7.4 and earlier) contains a critical unauthenticated SQL injection vulnerability that allows direct access to the WordPress backend database without authentication.

How to fix or mitigate CVE-2026-54825?

24 hours: Identify all WordPress instances running wpDataTables ≤7.4; deploy Web Application Firewall rules to block SQL injection patterns; disable plugin if business operations permit. 7 days: Enable database query monitoring and alerting; audit SIEM logs (prior 30 days) for exploitation indicators; test database backup restoration procedures. 30 days: Apply vendor patch upon release; conduct forensic database audit to confirm no unauthorized access; establish permanent WAF protections for SQL injection variants.

wpDataTables CVE-2026-54825

EUVD-2026-39672 CRITICAL

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-q844-rcc5-845v

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi with low complexity (PR:N/AV:N/AC:L); high confidentiality from data extraction, with limited integrity potential and scope kept Unchanged absent evidence of cross-component impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:32 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.

AnalysisAI

Unauthenticated SQL injection in the wpDataTables WordPress plugin (versions up to and including 7.4) lets remote attackers inject crafted SQL into database queries without any authentication or user interaction, exposing the WordPress backend database. With a CVSS 9.3 (critical) score and a CWE-89 root cause, the flaw enables extraction of sensitive data such as user credentials and configuration secrets. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

wpDataTables is a commercial WordPress plugin for building and rendering interactive tables and charts, which it does by issuing SQL queries against the WordPress MySQL/MariaDB database and, in many deployments, against external data sources. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaches a query without proper parameterization or escaping. Because the plugin processes table/query parameters that can be supplied by unauthenticated requests, attacker-controlled values are concatenated into SQL statements, allowing query structure manipulation. The CPE/affected-version data here is limited to the plugin name and the 'up to 7.4' range; no exact vulnerable component or sink is enumerated in the provided intelligence.

RemediationAI

No vendor-released patch version is identified at time of analysis from the provided data; the only reference is the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-7-4-sql-injection-vulnerability?_s_id=cve, which should be consulted for the official fixed version. Administrators should upgrade wpDataTables to the first release above 7.4 once confirmed by the vendor, and in the interim apply compensating controls: place the site behind a WAF or Patchstack vPatch rule that blocks SQL-injection patterns on wpDataTables endpoints, restrict or disable the plugin's public/AJAX table-rendering endpoints if not required (trade-off: front-end tables for anonymous visitors will stop working), and deactivate the plugin entirely on high-risk sites until patched (trade-off: loss of all table/chart functionality). Enforce least-privilege on the database account WordPress uses so a successful injection cannot read tables outside the WordPress schema, and monitor query logs for anomalous statements.