CVE-2022-4063: InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-19 · updated 2026-06-17
Weakness: CWE-22

Description

The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.

Affected products

RealMag777 InPost Gallery: before 2.1.4.1 — fixed in 2.1.4.1

How to fix

Upgrade to a fixed version: RealMag777 InPost Gallery 2.1.4.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/6bb07ec1-f1aa-4f4b-9717-c92f651a90a7
https://wpscan.com/vulnerability/6bb07ec1-f1aa-4f4b-9717-c92f651a90a7

Get alerted when CVE-2022-4063 or the next vulnerability affects your stack