Vulnerability · Published Sep 11, 2023 · Assigned by WPScan
CVE-2023-4314wpDataTables < 2.1.66 - Admin+ PHP Object Injection
High 7.2
In plain English
A high-severity security flaw in wpDataTables from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.6%top 24.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | wpDataTables | 0 – before 2.1.66 |
References
- https://wpscan.com/vulnerability/1ab192d7-72ac-4f12-8a51-f28ee4db91bc exploit, vdb-entry, technical-description