CVE-2023-4314: wpDataTables < 2.1.66 - Admin+ PHP Object Injection
The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this wpDataTables vulnerability?
The vulnerability ID for this wpDataTables vulnerability is CVE-2023-4314.
What is the severity of CVE-2023-4314?
The severity of CVE-2023-4314 is high with a severity value of 7.2.
What is the impact of CVE-2023-4314?
The impact of CVE-2023-4314 is the potential for remote code execution if a suitable gadget chain is present on the server.
Which software versions are affected by CVE-2023-4314?
The wpDataTables WordPress plugin versions up to and excluding 2.1.66 are affected by CVE-2023-4314.
How can I fix the CVE-2023-4314 vulnerability?
To fix the CVE-2023-4314 vulnerability, update the wpDataTables WordPress plugin to version 2.1.66 or later.