CVE-2022-4302

The White Label CMS plugin through version 2.4 contains a PHP Object Injection vulnerability in its legacy_import function, which deserializes user-controlled data without proper validation. While the plugin itself lacks a gadget chain to exploit this flaw, attackers with administrator access could leverage chains from other installed plugins or themes to perform dangerous actions such as arbitrary file deletion, information disclosure, or remote code execution.

Based on public CVE data (MITRE/NVD).