Logo Showcase Ultimate Plugin Vulnerable to PHP Object Injection

CVE-2024-1951

Summary

The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress contains a vulnerability that enables PHP Object Injection through deserialization of untrusted input via shortcode in all versions up to and including 1.3.8. This issue could allow authenticated attackers with contributor access and higher to inject a PHP Object into the system. While the vulnerable plugin does not include a payload execution chain (POP), if other plugins or themes installed on the target site possess such a chain, the results could be severe, potentially leading to arbitrary file deletion, unauthorized data access, or malicious code execution.

References