7.2

CVE-2023-4314

Exploit

wpDataTables < 2.1.66 - Admin+ PHP Object Injection

wpDataTables - Tables & Table Charts <= 2.1.65 - Authenticated(Administrator+) PHP Object Injection

The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.
Mögliche Gegenmaßnahme
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin: Update to version 2.1.66, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tms-outsource ≫ Wpdatatables SwPlatformwordpress Version < 2.1.66
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin
Version [*, 2.1.66)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.26% 0.658
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/1ab192d7-72ac-4f12-8a51-f28ee4db91bc
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/0c458644-a799-4bea-abcb-06a946dc19df
Third Party Advisory