TI-2022-03118 Aliases CVE-2022-3374 GHSA-2xq6-mr97-65fj

Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection

HIGH 67CWE-502Published 2022-10-31 · Updated 2025-05-06

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.

Summary

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01521 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Ocean Extra (Unknown): 2.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Ocean Extra	2.0.5 to before 2.0.5	2.0.5	Patch available	CNA

Ocean Extra VendorUnknown Affected 2.0.5 to before 2.0.5 Fixed in 2.0.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:oceanwp:ocean_extra::::::wordpress::*	before 2.0.5	Vulnerable	oceanwp

cpe:2.3:a:oceanwp:ocean_extra:*:*:*:*:*:wordpress:*:* Versions before 2.0.5 Vulnerable ·oceanwp

Remediation

Fix · CNA Ocean Extra (Unknown) Fixed in 2.0.5

Timeline

2026-10-02 Threatist record created from CVE-2022-3374
2026-10-03 Alias added: GHSA-2xq6-mr97-65fj

References

Exploit 1

https://wpscan.com/vulnerability/22fd3f28-9036-4bd5-ad98-ff78bd1b51bc

TI-2023-00711 Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure CVSS 3.1MEDIUM 6.5
TI-2025-03051 Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1CRITICAL 9.8
TI-2023-26823 WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
TI-2019-12232 includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows… CVSS 3.1HIGH 7.5
TI-2021-07382 Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
TI-2024-24993 WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences