CVE-2022-3366: high-severity vulnerability in PublishPress Capabilities Pro
PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection
Published · Updated
Follow this CVE+ Monitor Capabilities Pro+ Monitor Capabilities – User Role Access, Editor Permissions, Admin Menus
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 1.5%
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · PublishPress Capabilities ProUnknown · PublishPress Capabilities – User Role Access, Editor Permissions, Admin MenusRelated CVEs — PublishPress Capabilities Pro
In the same product, most dangerous first.