Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2022-4063

InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown InPost Gallery

Default version status: unaffected

  • 0 to < 2.1.4.1affected

References