CVE-2022-4060

CVE-2022-4060 is a critical-severity vulnerability in Odude User Post Gallery with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 43% places it in the 99th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.

Frequently asked questions

What is CVE-2022-4060?
The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.
How severe is CVE-2022-4060?
CVE-2022-4060 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-4060 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 43% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-4060?
CVE-2022-4060 affects Odude User Post Gallery. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-4060?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2022-4060 published?
CVE-2022-4060 was published on 2023-01-16 and last updated on 2026-06-17.

References

Affected products (1)