CVE-2022-3374

Published: Oct 31, 2022Modified: May 6, 2025

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

Affected (1)

Products: Oceanwp: Ocean Extra

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Oceanwp Ocean Extra	Before 2.0.5

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://wpscan.com/vulnerability/22fd3f28-9036-4bd5-ad98-ff78bd1b51bc

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/22fd3f28-9036-4bd5-ad98-ff78bd1b51bc

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.