CVE-2022-4324

high · 7.2

The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

7.2

CVSS

17.7%

EPSS (exploit prob.)

97th

EPSS percentile

2023-01-02

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
wpgogo	custom_field_template	< 2.5.8

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/70c39236-f7ae-49bf-a2f0-7cb9aa983e45
https://wpscan.com/vulnerability/70c39236-f7ae-49bf-a2f0-7cb9aa983e45

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-4324