{"cve":"CVE-2023-4314","nvd":{"published":"2023-09-11T20:15:12.310","modified":"2026-06-17T06:37:33.167","status":"Modified","description":"The wpDataTables WordPress plugin before 2.1.66 does not validate the \"Serialized PHP array\" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":[],"references":["https://wpscan.com/vulnerability/1ab192d7-72ac-4f12-8a51-f28ee4db91bc","https://wpscan.com/vulnerability/1ab192d7-72ac-4f12-8a51-f28ee4db91bc"],"products":["tms-outsource:wpdatatables"],"source":"nvd","synced_at":"2026-10-19T21:39:24.235896374+00:00"},"epss":{"cve":"CVE-2023-4314","score":0.01594,"percentile":0.75709,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}