CVE-2022-4324

Deeper analysis

The Custom Field Template WordPress plugin before version 2.5.8 is vulnerable to PHP object injection because it unserializes the contents of an imported file without sufficient validation. This occurs specifically when handling a Customizer Styling file, and the flaw is present whenever a suitable gadget chain exists elsewhere on the site.

A high-privilege user such as an administrator can trigger the issue, either intentionally or after being tricked into importing a malicious file. Successful exploitation yields high impact on confidentiality, integrity, and availability, consistent with the CVSS 7.2 rating that assumes network-reachable attack vectors and low attack complexity once the file is processed.

WPScan advisories for the vulnerability recommend updating the plugin to version 2.5.8 or later to eliminate the unsafe deserialization behavior. The EPSS score rose from a low baseline to a peak of 0.1415 before receding to the current value of 0.0117, indicating a temporary increase in observed exploitation interest after disclosure.