CVE-2023-4314: wpDataTables < 2.1.66 - Admin+ PHP Object Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-11 · updated 2026-06-17

Description

The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.

Affected products

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin: before 2.1.66 — fixed in 2.1.66

How to fix

Upgrade to a fixed version: wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin 2.1.66. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4314 or the next vulnerability affects your stack