CVE-2022-4060

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

42.72% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-94

Published

2023-01-16

Updated

2025-04-04

Proof-of-concept exploits (3)

• https://wpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e
• devmehedi101/wordpress-exploit0★ · 2023-11-20
• securi3ytalent/wordpress-exploit0★ · 2023-11-20

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4060.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-4061
• CVE-2023-38389
• CVE-2023-6063
• CVE-2022-4059
• CVE-2022-4058
• CVE-2022-40619