CVE Vulnerability

CVE-2022-3366

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.

7.2 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:publishpress:capabilities:*:*:*:*:pro:wordpress:*:*
cpe:2.3:a:publishpress:capabilities:*:*:*:*:-:wordpress:*:*
Information

Published : 2022-10-31 04:15

Updated : 2022-11-01 01:54

NVD link : CVE-2022-3366

Mitre link : CVE-2022-3366

Products Affected
No products.
CWE
CWE-502

Deserialization of Untrusted Data