CVE-2024-3820: 
WordPress vulnerability analysis and mitigation

CVE-2024-3820 affects the premium version of wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin for WordPress. The vulnerability was discovered in versions up to and including 6.3.1, with the disclosure date being June 1, 2024. This SQL injection vulnerability exists in the 'id_key' parameter of the wdt_delete_table_row AJAX action (NVD).

The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries in the wdt_delete_table_row AJAX action. This security flaw allows unauthenticated attackers to append additional SQL queries to existing ones, potentially enabling unauthorized data extraction from the database. The vulnerability has been assigned a CVSS v3.1 base score of 10.0 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) (SecurityOnline).

The vulnerability affects over 70,000 WordPress installations using the premium version of wpDataTables. Successful exploitation could lead to data breaches exposing confidential information stored within wpDataTables, website defacement, and potential account takeover if the database contains user credentials (SecurityOnline).

The vulnerability is particularly severe as it requires no authentication and can be exploited by unauthenticated attackers. The attack vector allows malicious actors to inject SQL queries into existing database queries, making it possible to extract sensitive information from the affected WordPress sites' databases (NVD).

The vulnerability has been patched in version 6.3.2 of wpDataTables. Users are strongly advised to update their installations immediately to this version to protect against potential exploitation (WPDataTables Changelog).