by Kastro
Paper/Archive/CVE-2022-4060

CVE-2022-4060

Unknown User Post Gallery — User Post Gallery <= 2.19 - Unauthenticated RCE

EPSS 43%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.7.987 × 2019.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.

Affected

ProductAffectedFixed inSource
User Post Gallery≤ 2.19–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e