What’s Vulnerable › Vulnerabilities

CVE-2022-3366: PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-10-31 · updated 2026-06-17
• Weakness: CWE-502

Description

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.

Affected products

• PublishPress Capabilities: before 2.5.2 — fixed in 2.5.2

How to fix

Upgrade to a fixed version: PublishPress Capabilities 2.5.2. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb
• https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb

Get alerted when CVE-2022-3366 or the next vulnerability affects your stack