CVE-2022-4043

WP Custom Admin Interface < 7.29 - Admin+ PHP Object Injection

High · published January 9, 2023

CVSS v3.1

7.2

EPSS

18%

Percentile

97.2

In the wild

Unconfirmed

What it is

The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.17686 · 97.2th percentile
Published: 2023-01-09T22:13Z

EPSS history

Timeline

09 JAN 22:13Z
WP Custom Admin Interface < 7.29 - Admin+ PHP Object Injection
cvelistv5