CVE-2022-4063
Last modified
CVE-2022-4063 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.. EPSS estimates a 9.52% chance of exploitation in the next 30 days.
Description
The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pluginus | Inpost Gallery | < 2.1.4.1 |
References
- https://wpscan.com/vulnerability/6bb07ec1-f1aa-4f4b-9717-c92f651a90a7Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/6bb07ec1-f1aa-4f4b-9717-c92f651a90a7Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-4063?
How severe is CVE-2022-4063?
How do I fix CVE-2022-4063?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-40622The WAVLINK Quantum D4G (WN531G3) running firmware version M…8.8
- CVE-2022-40623The WAVLINK Quantum D4G (WN531G3) running firmware version M…8.8
- CVE-2022-40624pfSense pfBlockerNG through 2.1.4_27 allows remote attackers…9.8
- CVE-2022-40626An unauthenticated user can create a link with reflected Jav…6.1
- CVE-2022-40628This vulnerability exists in Tacitine Firewall, all versions…9.8
- CVE-2022-40629This vulnerability exists in Tacitine Firewall, all versions…7.5
- CVE-2022-40630This vulnerability exists in Tacitine Firewall, all versions…9.8
- CVE-2022-40631A vulnerability has been identified in SCALANCE X200-4P IRT …6.1
- CVE-2022-40632Cross-Site Request Forgery (CSRF) vulnerability in gVectors …5.4
- CVE-2022-40633A malicious actor can clone access cards used to open contro…4.6
- CVE-2022-40634Improper Control of Dynamically-Managed Code Resources vulne…7.2
- CVE-2022-40635Improper Control of Dynamically-Managed Code Resources vulne…7.2
Are you affected by CVE-2022-4063?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST