CVE-2022-4063

Think of this plugin like a gallery display case on your storefront window — but this flaw lets a stranger reach through the glass, grab files they shouldn't have access to, and even rearrange the display to show whatever they want, all without needing a key. In the worst case, they can use this access to plant their own code and effectively run the store themselves.

This matters to you if your WordPress website uses the InPost Gallery plugin. The flaw is exploitable directly from the internet by anyone, with no account or login needed, so if the plugin is installed and active, your site is reachable and at risk by default.

A public exploit for this flaw already exists, meaning attackers have a ready-made tool to attack vulnerable sites, and press attention around this issue is increasing. It has not yet been confirmed as actively exploited in widespread attacks, but given the ease of exploitation and public availability of attack code, this should be treated as a priority to fix soon rather than an emergency to drop everything for.

Confirm the installed version of the InPost Gallery plugin via WordPress admin or by checking the plugin's readme.txt file. Any version prior to 2.1.4.1 is vulnerable. Upgrade to version 2.1.4.1 or later, which removes the insecure extract() usage in view rendering. There is no documented breaking-change concern for this upgrade. If immediate patching isn't possible, deactivate or remove the plugin, and consider a WAF rule blocking suspicious file-inclusion parameters (e.g., path traversal sequences or remote URLs in plugin request parameters) as a temporary mitigation. Monitor web server logs for unusual requests to plugin-related endpoints referencing unexpected file paths or external URLs, and check for newly created admin users or unfamiliar PHP files in the wp-content directory as indicators of prior compromise. No CISA KEV listing exists, so there is no federal remediation deadline, but a public exploit's existence warrants prompt action.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no authentication or user interaction required, with full impact to confidentiality, integrity, and availability. Weakness is CWE-22 (Path Traversal), manifesting as unauthenticated Local File Inclusion via insecure extract() calls, escalatable to Remote Code Execution through local/remote file inclusion. Not listed in CISA KEV; no confirmed in-the-wild exploitation has been reported. A public proof-of-concept exploit exists, indicating moderate exploit maturity. EPSS places predicted exploitation likelihood in a high percentile relative to all scored CVEs, though the trend is currently falling. Press/pulse attention is rising, which may increase attacker interest independent of confirmed exploitation.