CVE-2022-3360

CVE-2022-3360 is a high-severity PHP Object Injection vulnerability affecting the LearnPress WordPress plugin versions prior to 4.1.7.2. This flaw allows unauthenticated attackers to potentially achieve remote code execution (RCE) by unserializing malicious user input via a REST API endpoint. Exploitation requires knowledge of site secrets to generate a valid hash. The vulnerability has a CVSS score of 8.1 (High), indicating a critical risk due to its network attack vector, high impact on confidentiality, integrity, and availability, despite requiring high attack complexity. Its EPSS score is 0.1516, suggesting a moderate likelihood of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or community discussion has been observed for this CVE. It is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.