What is the CVSS score of CVE-2026-3017?

CVE-2026-3017 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-3017?

Smart Post Show WordPress plugin versions 3.0.12 and earlier contain a PHP object injection vulnerability in the import_shortcodes() function that could enable remote code execution or data theft if…

How to fix or mitigate CVE-2026-3017?

Within 24 hours: Disable the Smart Post Show plugin or restrict administrator access to import_shortcodes functionality via code modification if disabling is not feasible. Audit all installed WordPress plugins and themes for known PHP object injection gadget chains using a security scanner. Within 7 days: Inventory all administrator accounts and review their access logs for suspicious import activity. Evaluate alternative shortcode plugins without known injection vulnerabilities. Within 30 days: Monitor vendor advisory channels for a patched version of Smart Post Show and upgrade immediately upon release; consider replacing the plugin if no patch timeline is provided.

PHP CVE-2026-3017

EUVD-2026-22221 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-04-14 Wordfence

GHSA-vw96-fcx4-fx55

PHP WordPress Information Disclosure Deserialization

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 05:56 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 05:45 euvd

EUVD-2026-22221

Analysis Generated

Apr 14, 2026 - 05:45 vuln.today

CVE Published

Apr 14, 2026 - 05:30 nvd

HIGH 7.2

DescriptionCVE.org

The Smart Post Show - Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.12 via deserialization of untrusted input in the import_shortcodes() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

AnalysisAI

PHP object injection in Smart Post Show WordPress plugin versions ≤3.0.12 allows administrators to deserialize untrusted input via the import_shortcodes() function. While no POP chain exists in the plugin itself (making direct exploitation impossible), the vulnerability becomes critical if paired with another plugin/theme containing exploitable gadget chains, potentially enabling file deletion, data exfiltration, or remote code execution. CVSS 7.2 (High) reflects theoretical maximum impact. No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE identifier.

Technical ContextAI

This vulnerability (CWE-502: Deserialization of Untrusted Data) occurs in the Smart Post Show plugin's import_shortcodes() function, which processes serialized PHP objects without proper validation. PHP object injection exploits require two components: an unsafe unserialize() call (present here) and a Property-Oriented Programming (POP) chain-a sequence of magic methods (__wakeup, __destruct, __toString) in loaded classes that can be chained together for malicious effects. The vulnerable plugin itself lacks exploitable POP gadgets, making this a conditional vulnerability dependent on the WordPress site's complete plugin/theme ecosystem. Attack success requires administrator credentials (PR:H in CVSS vector), significantly limiting the threat surface to compromised admin accounts or malicious insiders. The affected product per CPE is specifically the ShapedPlugin Smart Post Show plugin for WordPress through version 3.0.12.

RemediationAI

Immediately upgrade Smart Post Show plugin to version 3.0.13 or later, which addresses the unsafe deserialization vulnerability as documented in WordPress Trac changeset 3490703 at https://plugins.trac.wordpress.org/changeset/3490703/post-carousel. Site administrators should audit all installed plugins and themes to identify potential POP chain gadgets (commonly found in outdated libraries like PHPMailer, Guzzle, or Monolog) and update those components as well. Implement principle of least privilege by restricting administrator role assignments and enabling multi-factor authentication for all privileged accounts to mitigate the PR:H prerequisite. Monitor WordPress admin activity logs for unexpected shortcode import operations. For sites unable to update immediately, consider temporarily disabling the plugin's import functionality if business operations permit, though no specific workaround exists that maintains full plugin features. Vendor security advisory and technical details available at https://www.wordfence.com/threat-intel/vulnerabilities/id/45690747-0b8d-4e2e-8dd0-07c12791c064.