PT-2023-28714 · Unknown · Wpdatatables

Jonatas Souza Villa Flor · Published 2023-09-11 · Updated 2023-09-19 · CVE-2023-4314

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wpDataTables versions prior to 2.1.66

Description The issue concerns the deserialization of arbitrary data due to a lack of validation of the Serialized PHP array input data. This can potentially lead to remote code execution if a suitable gadget chain is present on the server, particularly impacting environments where admin users should not be allowed to execute arbitrary code, such as multisite.

Recommendations For versions prior to 2.1.66, update to version 2.1.66 or later to resolve the issue. As a temporary workaround, consider restricting access to the deserialization functionality to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-4314

Affected Products

Wpdatatables

References · 4

• 🔥 https://wpscan.com/vulnerability/1ab192d7-72ac-4f12-8a51-f28ee4db91bc · Exploit
• https://osv.dev/vulnerability/CVE-2023-4314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4314 · Security Note
• https://twitter.com/CVEnew/status/1701323270732316800 · Twitter Post