CVE-2021-24198: 
WordPress vulnerability analysis and mitigation

The wpDataTables WordPress plugin versions before 3.4.2 contained an Improper Access Control vulnerability (CVE-2021-24198). This security flaw affected the premium version of the plugin, though both premium and free plugins share the same slug. The vulnerability was discovered by researchers Veno Eivazian and Massimiliano Ferraresi, and was publicly disclosed on March 16, 2021 (WPScan).

The vulnerability stems from improper access control mechanisms where authenticated users with low privileges can manipulate the id_key and id_val parameters when visiting a page with a published table. The issue is classified as CWE-284 (Improper Access Control) and received a CVSS score of 6.5 (Medium) (WPScan, Security Advisory).

When exploited, this vulnerability allows an attacker to delete data belonging to other users within the same table. The impact is significant as it could lead to unauthorized deletion of data across the entire table, potentially affecting all users' information (Security Advisory).

The vulnerability can be exploited by any authenticated user, even with low privileges, who has access to pages where tables are published. The attacker needs to manipulate the id_key and id_val parameters in HTTP requests to delete data belonging to other users (Security Advisory).

The vulnerability was patched in wpDataTables version 3.4.2, released on March 10, 2021. Users are strongly advised to upgrade to this version or later to protect against this security issue (Changelog).