CVE-2026-49080: WordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the wpDataTables WordPress plugin at version 7.3.6 and earlier. The flaw is reachable over the network without any login or account, meaning any external attacker who can reach the WordPress site can send a crafted request directly to the vulnerable endpoint. Successful exploitation gives the attacker read access to database contents and limited ability to disrupt service availability. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to send HTTP requests to the WordPress installation.

• AuthenticationNot required

  No account or session credential of any kind is needed to reach or exploit the vulnerable parameter.

• Victim interactionNot required

  The attack is fully server-side; no user action such as clicking a link or visiting a page is required.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions, memory-layout dependencies, or other environmental factors required.

Blast Radius

• Attacker can read arbitrary rows from the WordPress database, including stored user credentials, session tokens, private post content, and plugin configuration data.
• Database confidentiality is fully compromised within the scope of the MySQL user account the WordPress installation uses, which commonly spans multiple tables and in shared-hosting environments may span multiple sites.
• The A:L impact rating indicates the attacker can cause partial availability disruption, such as resource exhaustion on the database server through query flooding.