CVE-2022-3366 PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection
Administrators can trigger PHP object injection via imported files in multisite setups, potentially leading to code execution if gadget chains exist.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3366?
CVE-2022-3366 is a high-severity unsafe deserialization vulnerability in Unknown PublishPress Capabilities Pro, published on 31 Oct 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
Weakness: CWE-502
Which versions are affected by CVE-2022-3366?
It affects 1 product.
Products include Publishpress Capabilities.
How do I fix CVE-2022-3366?
No fix has been published for CVE-2022-3366 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-3366 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3366 exists.
Other vulnerabilities in Unknown PublishPress Capabilities Pro
Sources
Also known as GHSA-x27x-7595-v3m5.