WordPress YouTube Showcase Plugin Code Injection Vulnerability

A PHP object injection vulnerability allowing code injection has been identified in the WordPress YouTube Showcase plugin, affecting versions through 3.5.1. This vulnerability arises from improper control over code generation, which could lead to object injection exploits.

Impact

Exploitation of this vulnerability could allow for PHP object injection, potentially leading to code execution, SQL injection, path traversal, denial of service, and more, if a suitable payload chain is available.

Remediation

Users of the WordPress YouTube Showcase plugin should update to version 3.5.2 or later. Patchstack users can enable auto-updates for vulnerable plugins.