CVE-2022-3366 PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection

2022-10-3100:00:00

CWE-502

WPScan

www.cve.org

php object injection

publishpress capabilities

wordpress plugin

cve-2022-3366

admin+

multisite configuration

gadget chain

EPSS

0.001

Percentile

42.9%

JSON

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus",
    "versions": [
      {
        "version": "2.5.2",
        "status": "affected",
        "lessThan": "2.5.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Unknown",
    "product": "PublishPress Capabilities Pro",
    "versions": [
      {
        "version": "2.5.2",
        "status": "affected",
        "lessThan": "2.5.2",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb

EPSS

0.001

Percentile

42.9%

JSON

Related for CVELIST:CVE-2022-3366