A WP Life Slider PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WordPress plugin 'Slider Responsive Slideshow – Image slider, Gallery slideshow', affecting versions through 1.5.4. This vulnerability could lead to various injection attacks, including code injection, SQL injection, and path traversal, among others, if a suitable property-oriented programming chain is exploited.

Impact

Exploitation of this vulnerability could allow for PHP object injection, which might be leveraged to execute code injection, SQL injection, path traversal, denial-of-service attacks, and more, provided that a proper object-oriented programming chain is available.

Remediation

Users are advised to update to a version later than 1.5.4. For those using Patchstack, a mitigation rule has been issued to block attacks targeting this vulnerability until an official patch can be safely applied.