CVE-2022-4302
Published: 02 January 2023
Summary
CVE-2022-4302 is a high-severity an unspecified weakness vulnerability in Videousermanuals White Label Cms. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 20.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The White Label CMS WordPress plugin before version 2.5 contains a PHP Object Injection vulnerability. The flaw stems from unsafe deserialization of user-supplied settings values, allowing an attacker to instantiate arbitrary PHP objects when a suitable gadget chain is available in the environment.
High-privilege users such as administrators can exploit the issue over the network by modifying plugin settings. Successful exploitation can result in impacts to confidentiality, integrity, and availability, as reflected in the CVSS 7.2 rating that assumes no user interaction and low attack complexity.
The referenced WPScan advisory identifies the affected plugin versions and indicates that the issue is resolved in release 2.5 and later. Site administrators should update the plugin to eliminate the unsafe unserialize call.
EPSS for this CVE rose from a low baseline to a peak of 0.1415 on 2025-12-11 before receding to the current value of 0.0117, indicating that exploitation interest increased well after initial disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-51658
Vulnerability details
The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.