CVE-2022-4265: Replyable < 2.2.10 - Subscriber+ PHP Object Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-06 · updated 2026-06-17
Weakness: CWE-352

Description

The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the prompt_dismiss_notice action and also lacks CSRF check in the related action. This could allow any authenticated users, such as subscriber to perform Object Injection attacks. The attack could also be done via a CSRF vector against any authenticated user

Affected products

Replyable: before 2.2.10 — fixed in 2.2.10

How to fix

Upgrade to a fixed version: Replyable 2.2.10. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/095cba08-7edd-41fb-9776-da151c0885dd
https://wpscan.com/vulnerability/095cba08-7edd-41fb-9776-da151c0885dd

Get alerted when CVE-2022-4265 or the next vulnerability affects your stack