What’s Vulnerable › Vulnerabilities

CVE-2022-4302: White Label CMS < 2.5 - Admin+ PHP Object Injection

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 17.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-02 · updated 2026-06-17

Description

The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

Affected products

• White Label CMS: before 2.5 — fixed in 2.5

How to fix

Upgrade to a fixed version: White Label CMS 2.5. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/b7707a15-0987-4051-a8ac-7be2424bcb01
• https://wpscan.com/vulnerability/b7707a15-0987-4051-a8ac-7be2424bcb01

Get alerted when CVE-2022-4302 or the next vulnerability affects your stack