PT-2022-21796 · Publishpress · Publishpress Capabilities Pro

Nguyen Pham Viet Nam · Published 2022-10-31 · Updated 2022-11-01 · CVE-2022-3366

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PublishPress Capabilities WordPress plugin versions prior to 2.5.2 PublishPress Capabilities Pro WordPress plugin versions prior to 2.5.2

Description The issue allows PHP object injection attacks by administrators on multisite WordPress configurations. This can happen when the content of imported files is unserialized. Successful exploitation requires the presence of other plugins with a suitable gadget chain on the site.

Recommendations For PublishPress Capabilities WordPress plugin versions prior to 2.5.2, update to version 2.5.2 or later. For PublishPress Capabilities Pro WordPress plugin versions prior to 2.5.2, update to version 2.5.2 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-3366

Affected Products

Publishpress Capabilities Pro

References · 4

• 🔥 https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3366 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3366 · Vendor Advisory
• https://t.me/cibsecurity/52307 · Telegram Post