CVE-2024-3820: wpDataTables Plugin SQLi Vulnerability

CVE-2024-3820 Overview

CVE-2024-3820 is a critical SQL Injection vulnerability affecting the wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin for WordPress. The vulnerability exists in the id_key parameter of the wdt_delete_table_row AJAX action in all versions up to and including 6.3.1. Due to insufficient escaping on user-supplied parameters and lack of proper SQL query preparation, unauthenticated attackers can append malicious SQL queries to existing database queries, potentially extracting sensitive information from the WordPress database.

Critical Impact
This vulnerability allows unauthenticated remote attackers to perform SQL injection attacks, potentially compromising the entire WordPress database including user credentials, sensitive data, and site configuration. Only the premium version of the plugin is affected.

Affected Products

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin (Premium) versions up to and including 6.3.1
WordPress installations with the affected plugin versions

Discovery Timeline

June 1, 2024 - CVE-2024-3820 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-3820

Vulnerability Analysis

This SQL Injection vulnerability stems from a classic input validation failure in the wpDataTables premium plugin. The wdt_delete_table_row AJAX action accepts an id_key parameter that is directly incorporated into SQL queries without proper sanitization or parameterization. Because the plugin fails to use prepared statements or adequate input escaping, attackers can manipulate the SQL query structure by injecting malicious payloads through this parameter.

The vulnerability is particularly dangerous because it requires no authentication—any remote attacker can exploit this flaw by sending crafted AJAX requests to the WordPress site. Successful exploitation enables attackers to read arbitrary data from the database, potentially including administrator credentials, user personal information, and other sensitive content stored in WordPress tables.

Root Cause

The root cause of CVE-2024-3820 is insufficient escaping on user-supplied input combined with the absence of prepared statements in the SQL query handling. When the wdt_delete_table_row AJAX action processes the id_key parameter, it directly concatenates user input into the SQL query string rather than using WordPress's built-in $wpdb->prepare() function or other parameterized query methods. This allows SQL metacharacters in the input to alter the query's logic.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP POST requests to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to wdt_delete_table_row and a specially crafted id_key parameter containing SQL injection payloads.

The injected SQL can utilize techniques such as UNION-based injection to retrieve data from other tables, time-based blind injection to infer data character by character, or error-based injection to extract information through database error messages. Since WordPress databases typically contain sensitive information including user accounts with hashed passwords, successful exploitation can lead to complete site compromise.

For detailed technical analysis of this vulnerability, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-3820

Indicators of Compromise

Suspicious POST requests to /wp-admin/admin-ajax.php containing wdt_delete_table_row action with malformed or unusual id_key parameters
Database query logs showing unexpected SQL syntax including UNION, SELECT, or comment sequences (-- or #) in table row deletion operations
Web server access logs with multiple rapid requests to the AJAX endpoint from single IP addresses
Anomalous database read patterns or unexpected data exfiltration attempts

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to WordPress AJAX endpoints
Monitor WordPress AJAX action logs for wdt_delete_table_row calls with suspicious parameter values containing SQL keywords or special characters
Deploy intrusion detection systems (IDS) with signatures for common SQL injection payloads targeting the id_key parameter
Review database slow query logs for unusual queries originating from the wpDataTables plugin

Monitoring Recommendations

Enable detailed logging on the WordPress database server to capture all queries executed by the wpDataTables plugin
Configure alerts for any SQL errors or exceptions generated during table row deletion operations
Monitor network traffic for patterns consistent with automated SQL injection tools targeting WordPress sites
Implement database activity monitoring to detect unauthorized data access or extraction attempts

How to Mitigate CVE-2024-3820

Immediate Actions Required

Update wpDataTables premium plugin to version 6.3.2 or later immediately
If immediate patching is not possible, temporarily disable the wpDataTables plugin until the update can be applied
Review database logs for any evidence of prior exploitation attempts
Consider implementing a Web Application Firewall with SQL injection protection rules

Patch Information

The wpDataTables development team has addressed this vulnerability in versions after 6.3.1. Administrators should update to the latest available version through the WordPress plugin update mechanism or by downloading directly from the official wpDataTables website. Review the wpDataTables Changelog for complete version history and security fixes.

Workarounds

Temporarily disable the wpDataTables plugin if updating is not immediately possible
Implement WAF rules to block requests containing SQL injection patterns in the id_key parameter
Restrict access to the WordPress AJAX endpoint (admin-ajax.php) using server-level access controls where feasible
Consider using a security plugin that provides real-time protection against SQL injection attacks

bash

# Example: Block suspicious requests at the web server level (Apache)
# Add to .htaccess file in WordPress root
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} admin-ajax\.php
RewriteCond %{QUERY_STRING} wdt_delete_table_row [NC,OR]
RewriteCond %{HTTP:Content-Type} wdt_delete_table_row [NC]
RewriteRule .* - [F,L]
</IfModule>