10Web Slider CVE-2026-105885

Exploitation requires an authenticated session with at least low-privilege access (CVSS PR:L) to the WordPress site running Slider by 10Web (slider-wd) version 1.2.62 or earlier, reachable over the network with no user interaction. The core limiting factor is twofold: (1) the attacker must hold valid credentials or be able to register an account, and (2) object injection only yields meaningful impact (RCE, file write, data tampering) if a POP gadget chain is reachable in WordPress core or a co-installed plugin/theme - without a gadget chain, impact is reduced to the deserialization itself. The advisory does not confirm the exact vulnerable endpoint or whether a gadget chain ships with the plugin.

This is a PHP Object Injection flaw (CWE-502) in the Slider by 10Web WordPress plugin, scored CVSS 8.8 with vector AV:N/AC:L/PR:L/UI:N and full H/H/H impact, indicating network-exploitable, low-complexity attacks requiring some level of authentication (PR:L). No EPSS score, KEV listing, or public POC was provided in the input, so exploitation likelihood cannot be quantified from the available signals - there is no public exploit identified at time of analysis and no evidence of active exploitation. The high CVSS is driven by the full-impact object-injection primitive (which can escalate to RCE, data theft, or site takeover IF a usable POP gadget chain exists in WordPress core or co-installed plugins/themes), but the real-world risk is tempered by the PR:L authentication requirement: an attacker must first obtain at least a low-privileged authenticated session. The absence of KEV/EPSS/POC data means this is currently a high-severity-by-CVSS but unproven-exploitation issue; it warrants prompt patching but is not confirmed as an urgent in-the-wild threat. Note that object-injection severity is highly dependent on the presence of a gadget chain, which the Patchstack advisory does not confirm - real impact may be lower if no gadget is reachable.

An authenticated low-privileged user (e.g., subscriber or contributor) submits a crafted serialized PHP payload to a vulnerable slider-handling endpoint, which is passed to unserialize(). If a suitable POP gadget chain is present in WordPress core or another installed component, the injected object triggers arbitrary code execution, file operations, or data manipulation. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or conditions are needed once a valid account exists.