CVE-2022-3380

Name of the Vulnerable Software and Affected Versions Customizer Export/Import WordPress plugin versions prior to 0.9.5

Description The issue arises from the plugin unserializing the content of an imported file, potentially leading to PHP object injection issues when a malicious file is imported by an admin, and a suitable gadget chain is present on the blog.

Recommendations For versions prior to 0.9.5, update to version 0.9.5 or later to resolve the issue. As a temporary workaround, consider restricting the import functionality to trusted sources until the update is applied.