9.8

CVE-2022-4060

Exploit

User Post Gallery <= 2.19 - Unauthenticated RCE

User Post Gallery - UPG <= 2.19 - Missing Authorization to Remote Command Execution

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.
Mögliche Gegenmaßnahme
User Post Gallery – UPG: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Odude ≫ User Post Gallery SwPlatformwordpress Version <= 2.19
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt User Post Gallery – UPG
Version 2.19
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 42.72% 0.985
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/19c370f1-322b-4c35-b100-244547373e1a
Third Party Advisory