CVE-2023-4314 wpDataTables < 2.1.66 - Admin+ PHP Object Injection

What is CVE-2023-4314?

CVE-2023-4314 is a high-severity unsafe deserialization vulnerability in Unknown wpDataTables, published on 11 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.

Which versions are affected by CVE-2023-4314?

It affects 1 product.

Products include Tms-Outsource Wpdatatables.

How do I fix CVE-2023-4314?

No fix has been published for CVE-2023-4314 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-4314 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4314 exists.

Other vulnerabilities in Unknown wpDataTables

• CVE-2021-24197 wpDataTables < 3.4.2 - Improper Access Control leading to Table Permission Takeover High 8.1
• CVE-2021-24198 wpDataTables < 3.4.2 - Improper Access Control leading to Table Data Deletion High 8.1
• CVE-2023-23876 WordPress wpDataTables Plugin <= 2.1.49 is vulnerable to Cross Site Scripting (XSS) Medium 6.5
• CVE-2021-24199 wpDataTables < 3.4.2 - Blind SQL Injection via start Parameter Medium 6.5
• CVE-2021-24200 wpDataTables < 3.4.2 - Blind SQL Injection via length Parameter Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j3w9-3jjx-5qp2.