CVE-2021-26754: Wpdatatables

Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days.

wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.

Affected products

• Wpdatatables Wpdatatables: before 3.4.1 (fixed in 3.4.1)

Published 2021-02-08. Last modified 2026-06-17.