wpDataTables EUVD-2026-37496

No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site with the wpDataTables plugin installed at version 7.3.6 or below, per CVSS AV:N/AC:L/PR:N/UI:N. The only prerequisites are network reachability to the WordPress site and that wpDataTables is active (the vulnerable endpoint is exposed to anonymous visitors). Limiting factors: the site must actually be running an affected version of this specific plugin; the impact scope (which tables and columns are reachable) depends on what data sources the site administrator has configured wpDataTables to query, and the database account's privileges constrain whether the injection is read-only or can be escalated to writes/file operations.

All available signals point to genuine high priority: CVSS 9.3 with AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated, low-complexity attack with no user interaction, and the S:C (scope change) reflects database access crossing the plugin's authorization boundary into broader WordPress data. The C:H/I:N/A:L impact profile is consistent with a read-oriented SQLi (data exfiltration via UNION or error/blind techniques) rather than arbitrary write - though depending on database privileges of the WordPress user, INTO OUTFILE or stacked-query escalation may still be possible. EPSS and KEV status are not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild use cannot be assessed from this data; given Patchstack's track record of disclosing widely scanned WordPress plugin issues and that no public exploit identified at time of analysis, defenders should assume opportunistic mass scanning will follow disclosure within days to weeks.

An attacker locates a public WordPress site running wpDataTables ≤ 7.3.6 (fingerprintable via /wp-content/plugins/wpdatatables/ asset paths) and sends a crafted HTTP request to a vulnerable AJAX/REST endpoint with a SQL payload in a table, filter, or sort parameter. They use UNION-based or time-based blind injection to enumerate wp_users and dump administrator password hashes and email addresses, then crack the hashes offline or pivot to wp_options to steal API keys and integration secrets. No authentication, user interaction, or social engineering is required.