CVE-2022-3374: Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-31 · updated 2026-06-17
Weakness: CWE-502

Description

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

Affected products

oceanwp Ocean Extra: before 2.0.5 — fixed in 2.0.5

How to fix

Upgrade to a fixed version: oceanwp Ocean Extra 2.0.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/22fd3f28-9036-4bd5-ad98-ff78bd1b51bc
https://wpscan.com/vulnerability/22fd3f28-9036-4bd5-ad98-ff78bd1b51bc

Get alerted when CVE-2022-3374 or the next vulnerability affects your stack