CVE-2026-54825: wpDataTables SQL Injection Vulnerability

CVE-2026-54825 Overview

CVE-2026-54825 is an unauthenticated SQL Injection vulnerability affecting the wpDataTables WordPress plugin in versions 7.4 and earlier. The flaw allows remote attackers to inject arbitrary SQL statements without any authentication or user interaction. wpDataTables is a widely deployed WordPress plugin used to build interactive tables and charts backed by SQL data sources, which increases the attack surface on affected sites.

The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Because the vulnerability is reachable over the network with low complexity and no privileges, it presents a direct path to database access on affected WordPress installations.

Critical Impact
Unauthenticated attackers can send crafted HTTP requests to a vulnerable WordPress site and execute arbitrary SQL against the backend database, exposing site content, user records, and session data.

Affected Products

wpDataTables WordPress plugin versions <= 7.4
WordPress sites with the wpDataTables plugin installed and active
Any environment where the plugin has network-reachable endpoints

Discovery Timeline

2026-06-26 - CVE-2026-54825 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-54825

Vulnerability Analysis

CVE-2026-54825 is an unauthenticated SQL Injection flaw in wpDataTables versions 7.4 and prior. The plugin exposes functionality that accepts attacker-controlled input and incorporates it into SQL queries without proper neutralization. Because authentication is not required, an attacker only needs network access to a vulnerable WordPress site to reach the vulnerable code path.

The changed scope in this vulnerability indicates that a successful attack impacts resources beyond the vulnerable component itself. In practice, SQL injection against a WordPress database exposes the wp_users and wp_usermeta tables, session tokens, and any custom tables the plugin manages. Attackers commonly use such flaws to enumerate administrator credentials or extract API keys stored in wp_options.

The EPSS data for this CVE indicates limited observed exploitation activity as of publication, but WordPress plugin SQL injection flaws are routinely automated once public proofs of concept appear.

Root Cause

The root cause is improper neutralization of special SQL characters in user-supplied input processed by wpDataTables endpoints. Parameter values are concatenated into SQL statements rather than being passed through parameterized queries or the $wpdb->prepare() API. The exact vulnerable parameter is documented in the Patchstack Vulnerability Report.

Attack Vector

An attacker sends a crafted HTTP request to a vulnerable wpDataTables endpoint on a target WordPress site. The request includes SQL metacharacters or a UNION-based payload in a parameter that reaches the database layer. The database executes the injected statement and returns results either in the HTTP response body or via inference through response timing and content differences. No credentials, tokens, or user interaction are required.

Verified proof-of-concept code is not publicly available at the time of publication. Refer to the Patchstack Vulnerability Report for technical detail on the affected parameter.

Detection Methods for CVE-2026-54825

Indicators of Compromise

Requests to wpDataTables plugin endpoints containing SQL metacharacters such as ', ", --, UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA.
Unusual SELECT or UNION queries in MySQL slow-query and general logs originating from the WordPress database user.
Unexpected outbound traffic from the web server following anomalous requests to /wp-admin/admin-ajax.php with action values tied to wpDataTables.
New administrative WordPress accounts or modified rows in wp_users following suspicious plugin traffic.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL injection payloads targeting wpDataTables request parameters.
Enable MySQL query logging and alert on queries containing UNION SELECT, information_schema, or excessive OR 1=1 patterns.
Correlate HTTP 500 responses from wpDataTables endpoints with the source IP to identify probing activity.
Inventory WordPress plugins across the estate and flag installations where wpdatatables reports a version at or below 7.4.

Monitoring Recommendations

Forward web server access logs and MySQL query logs to a central analytics platform and retain them for at least 90 days.
Monitor for spikes in requests to admin-ajax.php and REST routes registered by wpDataTables.
Alert on creation of WordPress users with the administrator role outside of change windows.
Track file-integrity events on wp-content/plugins/wpdatatables/ and the WordPress core directory.

How to Mitigate CVE-2026-54825

Immediate Actions Required

Identify all WordPress instances running wpDataTables and confirm the installed version through the WordPress admin plugin screen or by inspecting wp-content/plugins/wpdatatables/wpdatatables.php.
Update wpDataTables to a fixed version above 7.4 on every affected site.
If patching is not immediately possible, deactivate and remove the plugin until an update can be applied.
Rotate WordPress administrator passwords, database credentials, and any API keys stored in wp_options on sites where exploitation is suspected.

Patch Information

Refer to the Patchstack Vulnerability Report for the specific fixed version and vendor guidance. Apply the plugin update through the WordPress admin interface or via WP-CLI: wp plugin update wpdatatables. Confirm the version string reports higher than 7.4 after the update completes.

Workarounds

Restrict access to wpDataTables endpoints at the WAF or reverse proxy layer until the plugin is updated.
Apply virtual patching rules that reject requests containing SQL metacharacters in wpDataTables parameters.
Enforce least privilege on the WordPress database user by removing FILE, CREATE, and DROP privileges where not required.
Take a full backup of the WordPress database and files before applying changes so that recovery is possible if compromise is confirmed.

bash

# Update the wpDataTables plugin using WP-CLI
wp plugin update wpdatatables
wp plugin get wpdatatables --field=version