wpDataTables < 2.1.66 - Admin+ PHP Object Injection

CVE-2023-4314

Summary

The wpDataTables plugin for WordPress versions prior to 2.1.66 has a deserialization vulnerability that arises from improper validation of input data, specifically when handling serialized PHP arrays. This flaw enables administrative users to deserialize arbitrary data, potentially leading to remote code execution if a suitable gadget chain exists on the server. The risk is particularly acute in environments such as multisite setups, where admin rights should be restricted to prevent unauthorized code execution.

References