CVE-2022-3374

The Ocean Extra plugin for WordPress through version 2.0.4 is susceptible to PHP Object Injection due to improper handling of untrusted data during deserialization of customizer styling files. An attacker with administrator privileges could inject malicious PHP objects into the system. While the plugin itself lacks a gadget chain to execute arbitrary code, the presence of such chains in other installed plugins or themes could enable file deletion, data theft, or remote code execution.

Based on public CVE data (MITRE/NVD).