PublishPress Capabilities – User Role Editor, Access Permissions, Admin Menus, CVE-2022-3366

CVE, Research URL: CVE-2022-3366
Home page URL: Security reports for PublishPress Capabilities – User Role Editor, Access Permissions, Admin Menus
Application: PublishPress Capabilities – User Role Editor, Access Permissions, Admin Menus
Published on: Oct 31, 2022
Research Description: The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
Affected versions: max 1.5.9.
Status: vulnerable

PublishPress Capabilities &#8211; User Role Editor, Access Permissions, Admin Menus, CVE-2022-3366