CVE-2022-4324

Custom Field Template < 2.5.8 - Admin+ PHP Object Injection

High · published January 2, 2023

CVSS v3.1

7.2

EPSS

18%

Percentile

97.2

In the wild

Unconfirmed

What it is

The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.17686 · 97.2th percentile
Published: 2023-01-02T21:49Z

EPSS history

Timeline

02 JAN 21:49Z
Custom Field Template < 2.5.8 - Admin+ PHP Object Injection
cvelistv5