Vulnerability · Published Oct 31, 2022 · Assigned by WPScan
CVE-2022-3366PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection
High 7.2
In plain English
A high-severity unsafe deserialization in PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Official description
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus | 2.5.2 – before 2.5.2 |
| Unknown | PublishPress Capabilities Pro | 2.5.2 – before 2.5.2 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H