CVE-2022-4063: 
WordPress vulnerability analysis and mitigation

The InPost Gallery WordPress plugin before version 2.1.4.1 contains a critical vulnerability (CVE-2022-4063) discovered and disclosed on November 28, 2022. The vulnerability stems from insecure usage of PHP's extract() function when rendering HTML views, which affects the plugin's gallery functionality (WPScan).

The vulnerability is classified as a Local File Inclusion (LFI) that can be escalated to Remote Code Execution (RCE). It has received a CVSS score of 9.8 (Critical) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts. The vulnerability is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD).

The vulnerability allows unauthenticated attackers to force the inclusion of malicious files and URLs, potentially enabling them to execute arbitrary code on affected servers. This could lead to complete server compromise, data theft, and system manipulation (WPScan).

The vulnerability is exploitable without authentication and requires low attack complexity. Proof of concept code exists that demonstrates both file disclosure capabilities and full remote code execution through PHP filter chains. The exploit can be triggered via the wp-admin/admin-ajax.php endpoint using the inpost_gallery_get_gallery action (WPScan).

The vulnerability has been patched in version 2.1.4.1 of the InPost Gallery plugin. Site administrators are strongly advised to update to this version or later to protect against potential attacks (WPScan).