CVE-2026-28039
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The wpDataTables WordPress plugin (through 6.5.0.1) contains a PHP Local File Inclusion vulnerability due to improper control of filename in include/require statements.
Risk Assessment
An attacker could include local server files, potentially exposing sensitive data or leading to further site compromise.
Recommendation
Update wpDataTables to a version newer than 6.5.0.1 and review file access permissions on the server.
Other vulnerabilities in wpDataTables
See all- CVE-2026-66597High
Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to 6.5.1.4. An attacker can inject malicious script without authentication.
- CVE-2026-49080Critical
There is an unauthenticated SQL injection vulnerability in wpDataTables versions up to 7.3.6.
- CVE-2026-65509High
Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to and including 7.5.1.
- CVE-2026-57672High
The wpDataTables plugin version 6.5.1.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
Original NVD description (English source)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through 6.5.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS