CVE-2022-4063

The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

9.52% chance of exploitation in the next 30 days, 95th percentile

Nuclei

critical · CWE-22

Published

2022-12-19

Updated

2025-04-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6bb07ec1-f1aa-4f4b-9717-c92f651a90a7

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4063.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-40624
• CVE-2022-40634
• CVE-2022-40623
• CVE-2022-40635
• CVE-2022-40622
• CVE-2022-4064