CVE-2022-4043

Deeper analysis

The WP Custom Admin Interface WordPress plugin before version 7.29 contains a PHP Object Injection vulnerability stemming from unsafe deserialization of user-supplied settings data. The affected component is the plugin's configuration handling routine, which processes untrusted input without proper sanitization or validation before passing it to PHP's unserialize function.

High-privilege users such as administrators can supply malicious serialized objects through the plugin settings interface. When a suitable gadget chain is present in the WordPress environment, successful exploitation grants the attacker the ability to execute arbitrary code, manipulate application state, or access sensitive data, corresponding to the CVSS 7.2 rating that reflects network-reachable impact on confidentiality, integrity, and availability without user interaction.

The referenced WPScan advisory identifies the flaw in versions prior to 7.29 and indicates that updating to the fixed release eliminates the unsafe unserialize call, serving as the primary mitigation.

EPSS for this CVE rose materially from a low baseline to a peak of 0.1415 before receding to the current value of 0.0117, indicating a period of increased exploitation interest well after the 2023 disclosure.