Saoshyant Slider PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Saoshyant Slider WordPress plugin, affecting versions through 3.0. This vulnerability could lead to PHP object injection, with potential consequences such as code execution, SQL injection, path traversal, or denial-of-service, depending on the presence of a suitable property-oriented programming chain.

Impact

Exploitation of this vulnerability could allow for PHP object injection, with associated risks of code execution, SQL injection, path traversal, denial-of-service, and more, if a proper property-oriented programming chain is available.

Remediation

Users are advised to update to a version of the Saoshyant Slider WordPress plugin that is later than 3.0. For those using Patchstack, a virtual patch is available to mitigate this vulnerability until an official fix can be applied.