The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb | Exploit Third Party Advisory |
https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:19
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb - Exploit, Third Party Advisory |
Information
Published : 2022-10-31 16:15
Updated : 2024-11-21 07:19
NVD link : CVE-2022-3366
Mitre link : CVE-2022-3366
CVE.ORG link : CVE-2022-3366
JSON object : View
Products Affected
publishpress
- capabilities
CWE
CWE-502
Deserialization of Untrusted Data