Vulnerability in The Slider Responsive Slideshow Allows PHP Object Injection

CVE-2024-1859

Summary

The Slider Responsive Slideshow plugin for WordPress exposes a vulnerability through PHP Object Injection due to the deserialization of untrusted input within the awl_slider_responsive_shortcode function. This flaw affects all versions of the plugin up to and including 1.3.8 and allows attackers with contributor-level access and above to inject PHP objects. Though there is no known object pollution (POP) chain present within the plugin itself, the potential exists for an attacker to exploit additional plugins or themes present on the target system. Consequently, this could lead to arbitrary file deletions, unauthorized access to sensitive data, or execution of malicious code.

References