{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28039", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-25T12:13:25.489Z", "datePublished": "2026-03-05T05:54:14.794Z", "dateUpdated": "2026-10-27T07:00:54.536Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-10-27T07:00:54.536Z"}, "title": "WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability", "datePublic": "2026-03-03T07:26:34.000Z", "descriptions": [{"lang": "en", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through 6.5.0.1.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.<p>This issue affects wpDataTables: from n/a through 6.5.0.1.</p>"}]}], "affected": [{"vendor": "TMS", "product": "wpDataTables", "packageName": "wpdatatables", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "versions": [{"version": "0", "versionType": "custom", "status": "affected", "lessThanOrEqual": "6.5.0.1", "changes": [{"at": "6.5.0.2", "status": "unaffected"}]}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-4-0-5-local-file-inclusion-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "credits": [{"lang": "en", "value": "Nguyen Xuan Chien | Patchstack Bug Bounty Program", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-98", "description": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-252", "descriptions": [{"lang": "en", "value": "PHP Local File Inclusion"}]}], "solutions": [{"lang": "en", "value": "Update the WordPress wpDataTables plugin to the latest available version (at least 6.5.0.2).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress wpDataTables plugin to the latest available version (at least 6.5.0.2)."}]}], "tags": ["x_known-exploited-vulnerability", "x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T18:14:16.718942Z", "id": "CVE-2026-28039", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T17:32:47.465Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28039", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T18:14:16.718942Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:13:48.564Z"}}], "cna": {"tags": ["x_known-exploited-vulnerability", "x_open-source"], "title": "WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Xuan Chien | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-252", "descriptions": [{"lang": "en", "value": "PHP Local File Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TMS", "product": "wpDataTables", "versions": [{"status": "affected", "changes": [{"at": "6.5.0.2", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "6.5.0.1"}], "packageName": "wpdatatables", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress wpDataTables plugin to the latest available version (at least 6.5.0.2).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress wpDataTables plugin to the latest available version (at least 6.5.0.2).", "base64": false}]}], "datePublic": "2026-03-03T07:26:34.000Z", "references": [{"url": "https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-4-0-5-local-file-inclusion-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through 6.5.0.1.", "supportingMedia": [{"type": "text/html", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.<p>This issue affects wpDataTables: from n/a through 6.5.0.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-10-27T07:00:54.536Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28039", "state": "PUBLISHED", "dateUpdated": "2026-10-27T07:00:54.536Z", "dateReserved": "2026-02-25T12:13:25.489Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-05T05:54:14.794Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "wpdatatables", "product": "wpDataTables", "vendor": "TMS", "versions": [{"changes": [{"at": "6.5.0.2", "status": "unaffected"}], "lessThanOrEqual": "6.5.0.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through 6.5.0.1."}, {"lang": "es", "value": "Vulnerabilidad de control inadecuado del nombre de fichero para la declaraci\u00f3n Include/Require en un programa PHP ('Inclusi\u00f3n remota de ficheros PHP') en wpDataTables wpDataTables wpdatatables permite la inclusi\u00f3n local de ficheros PHP. Este problema afecta a wpDataTables: desde n/d hasta &lt;= 6.5.0.1."}], "id": "CVE-2026-28039", "lastModified": "2026-10-27T08:16:53.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28039", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T18:14:16.718942Z", "version": "2.0.3"}}]}, "published": "2026-03-05T06:16:36.897", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-4-0-5-local-file-inclusion-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.5.0.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wpDataTables", "source": "cna", "vendor": "wpDataTables"}, "product": "wpdatatables", "vendor": "wpdatatables"}], "analysis": {"en": {"generated_at": "2026-04-15T23:11:03.734101+00:00", "value": {"mitigation_remediation": ["Apply the latest wpDataTables plugin release (6.6.0 or newer) to remove the LFI flaw", "If an immediate patch is unavailable or update is not possible, temporarily disable or uninstall the wpDataTables plugin to eliminate the vulnerable code path", "Configure web server or application firewall rules to restrict access to the wp-content/plugins/wpdatatables directory, preventing discovery and inclusion of arbitrary files"], "summary": {"action": "Patch", "impact": "Local File Inclusion enabling potential arbitrary code execution"}, "threat_synthesis": {"affected_systems": "WordPress sites running the wpDataTables plugin up to version 6.5.0.1 are affected. This includes all installations using locations of the plugin accessible through the web interface.", "description_and_impact": "A malformed include/require call in the wpDataTables WordPress plugin allows a local file inclusion flaw. An attacker can supply a crafted filename that leads the plugin to read files from the server\u2019s filesystem, potentially exposing sensitive data or including attacker\u2011controlled PHP code for execution. The flaw falls under CWE\u201198 and could compromise confidentiality, integrity, or availability of the affected web application if exploited.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity, but the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation likelihood. Likely attack vectors involve a local attacker with web access to the plugin directory, or an attacker leveraging other input channels in the plugin that allow manipulation of the include path. No public exploit code is documented at this time. The threat requires the attacker to send specific requests targeting the vulnerable include logic and is local to the web server environment."}}}}, "created": "2026-03-06T15:11:15.515061+00:00", "updated": "2026-04-15T23:15:17.766300+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpdatatables", "wpdatatables$PRODUCT$wpdatatables"]}