What’s Vulnerable › Vulnerabilities

CVE-2022-4323: Google Analyticator < 6.5.6 - Admin+ PHP Object Injection

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-23 · updated 2026-06-17

Description

The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present

Affected products

• Analyticator: before 6.5.6 — fixed in 6.5.6

How to fix

Upgrade to a fixed version: Analyticator 6.5.6. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/ce8027b8-9473-463e-ba80-49b3d6d16228
• https://wpscan.com/vulnerability/ce8027b8-9473-463e-ba80-49b3d6d16228

Get alerted when CVE-2022-4323 or the next vulnerability affects your stack