MetaSlider Responsive Slider PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WordPress plugin 'Responsive Slider by MetaSlider', affecting versions through 3.106.0. This vulnerability arises from the deserialization of untrusted data, which could potentially be exploited if a suitable property-oriented programming (POP) chain is available.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various types of code injection, such as SQL injection, path traversal, or denial-of-service, depending on the presence of a proper POP chain.

Remediation

Users of the 'Responsive Slider by MetaSlider' WordPress plugin should update to version 3.107.0 or later. Patchstack users can enable auto-update for vulnerable plugins.