WordPress Testimonial Slider PHP Object Injection Vulnerability

A vulnerability allowing deserialization of untrusted data has been identified in the WordPress Testimonial Slider plugin, affecting versions through 2.0.13. This vulnerability allows object injection, which could be exploited to execute code, inject SQL, traverse paths, cause a denial of service, and more, provided a suitable property-oriented programming chain is available.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing a range of attacks including code execution, SQL injection, path traversal, and denial of service.

Remediation

Users of the WordPress Testimonial Slider plugin should update to version 2.0.14 or later. Patchstack users can enable auto-update for vulnerable plugins.