GS Testimonial Slider CVE-2026-78527

Requires an authenticated WordPress account with at least Contributor-level privileges on a site running GS Testimonial Slider version 3.3.10 or earlier (PR:L; UI:N, so no victim interaction is needed once authenticated). Escalation from object injection to code execution further depends on a usable POP gadget chain existing in the plugin, WordPress core, or other installed plugins/themes. Limiting factors: the Contributor authentication requirement means anonymous exploitation is not possible, so risk is highest on sites that permit open or loosely vetted Contributor registration; the exact injectable parameter/sink is not described in the available sources.

This is a genuine prioritization candidate but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, 8.8) indicates a remotely reachable, low-complexity flaw with full confidentiality/integrity/availability impact, consistent with CWE-502 PHP object injection that can escalate to remote code execution. The decisive mitigating signal is PR:L: the title explicitly scopes this to a Contributor-level account, so the attacker must already hold a low-privileged authenticated role on the WordPress site rather than exploit anonymously. No EPSS score, no CISA KEV listing, and no confirmed public exploit were supplied, so there is no evidence of active or widespread exploitation; the only signal of urgency is the vuln.today 'this_week' decision label and Patchstack as reporter. Signals are therefore consistent rather than conflicting - high theoretical severity tempered by an authentication precondition and absent exploitation telemetry. Real-world impact to RCE also depends on a usable POP gadget chain being present in the plugin, WordPress core, or other installed components, which the supplied data does not confirm.

An attacker who holds (or registers, on sites allowing self-service Contributor signup) a Contributor account submits input that the plugin passes to PHP unserialize(), injecting a crafted serialized object. If a suitable POP gadget chain is available, deserialization leads to code execution or data compromise in the site context. No public exploit was identified in the supplied data, and the exact trigger/sink is not described in the available sources.