CVE-2022-3536: 
WordPress vulnerability analysis and mitigation

CVE-2022-3536 affects the Role Based Pricing for WooCommerce WordPress plugin versions prior to 1.6.3. The vulnerability was discovered and publicly disclosed on October 17, 2022. This security issue impacts WordPress installations using the affected plugin versions, particularly concerning authenticated users with subscriber-level access (WPScan).

The vulnerability is classified as an Object Injection/PHAR Deserialization vulnerability with a CVSS score of 7.5 (High). The security flaw stems from the plugin's lack of proper authorization and CSRF checks, combined with insufficient validation of user-input paths. The vulnerability is categorized under OWASP Top 10 A8: Insecure Deserialization and CWE-502 (WPScan).

The vulnerability allows any authenticated users, including those with basic subscriber privileges, to perform PHAR deserialization attacks when they can upload a file and a suitable gadget chain is present on the blog. This could potentially lead to arbitrary code execution on affected systems (WPScan).

The vulnerability has been patched in version 1.6.3 of the Role Based Pricing for WooCommerce plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).