CVE-2022-3366

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Oct 31, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-336604.9Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336616.5Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336626.5Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336636.5Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336644.9Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336656.5Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336666.5Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336676.5Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336684.9Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336694.9Azure Site Recovery Elevation of Privilege VulnerabilityCVE-2022-336707.8Windows Partition Management Driver Elevation of Privilege VulnerabilityCVE-2022-336714.9Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-3366: High severity, CVSS 7.2 | Vulnix