Lucene search
WPScanCVELIST:CVE-2023-4314HistorySep 11, 2023 - 7:46 p.m.
CVE-2023-4314 wpDataTables < 2.1.66 - Admin+ PHP Object Injection
2023-09-1119:46:06
WPScan
www.cve.org
2
wpdatatables
wordpress plugin
php object injection
admin
serialized php array
remote code execution
multisite
EPSS
0.002
Percentile
61.1%
The wpDataTables WordPress plugin before 2.1.66 does not validate the “Serialized PHP array” input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.
CNA Affected
[
{
"vendor": "Unknown",
"product": "wpDataTables",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "2.1.66"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
wpvulndb
wpvulndb
wpDataTables < 2.1.66 - Admin+ PHP Object Injection
2023-08-17 00:00:00
cve
cve
CVE-2023-4314
2023-09-11 20:15:12
prion
prion
Remote code execution
2023-09-11 20:15:00
wpexploit
wpexploit
wpDataTables < 2.1.66 - Admin+ PHP Object Injection
2023-08-17 00:00:00
nvd
nvd
CVE-2023-4314
2023-09-11 20:15:12