PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection
Priority HIGH 67CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.
Summary
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01485 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus (Unknown): 2.5.2PublishPress Capabilities Pro (Unknown): 2.5.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus | 2.5.2 to before 2.5.2 | 2.5.2 | Patch available | CNA |
| Unknown | PublishPress Capabilities Pro | 2.5.2 to before 2.5.2 | 2.5.2 | Patch available | CNA |
- PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus VendorUnknown Affected 2.5.2 to before 2.5.2 Fixed in 2.5.2 Patch available CNA
- PublishPress Capabilities Pro VendorUnknown Affected 2.5.2 to before 2.5.2 Fixed in 2.5.2 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:publishpress:capabilities:*:*:*:*:-:wordpress:*:* | before 2.5.2 | Vulnerable | PublishPress |
| cpe:2.3:a:publishpress:capabilities:*:*:*:*:pro:wordpress:*:* | before 2.5.2 | Vulnerable | PublishPress |
- cpe:2.3:a:publishpress:capabilities:*:*:*:*:-:wordpress:*:* Versions before 2.5.2 Vulnerable ·PublishPress
- cpe:2.3:a:publishpress:capabilities:*:*:*:*:pro:wordpress:*:* Versions before 2.5.2 Vulnerable ·PublishPress
Remediation
- Fix · CNA PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus (Unknown) Fixed in 2.5.2
- Fix · CNA PublishPress Capabilities Pro (Unknown) Fixed in 2.5.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3366
- 2026-10-03 Alias added: GHSA-x27x-7595-v3m5
References
More PublishPress Capabilities vulnerabilities
- TI-2021-07310 PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-3366 · CVE Program
- CVE-2022-3366 · NVD
- FIRST EPSS
- GHSA-x27x-7595-v3m5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences