Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.
AnalysisAI
PHP object injection in MetaSlider Responsive Slider plugin (WordPress) through version 3.106.0 allows authenticated administrators with high privileges to execute arbitrary code by deserializing untrusted data. The vulnerability requires authenticated high-privilege access (PR:H), limiting exploitation to compromised admin accounts or malicious insiders. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis.
Technical ContextAI
This is a PHP object injection vulnerability (CWE-502) in the MetaSlider Responsive Slider WordPress plugin. The affected product is identified by CPE cpe:2.3:a:metaslider:responsive_slider_by_metaslider affecting all versions through 3.106.0. CWE-502 (Deserialization of Untrusted Data) occurs when an application deserializes untrusted data without proper validation, allowing attackers to instantiate arbitrary PHP objects. In WordPress plugins, this typically manifests when user-supplied serialized data is passed to PHP's unserialize() function. Successful exploitation can trigger magic methods (__wakeup, __destruct, __toString) in available classes, leading to property-oriented programming (POP) chains that achieve remote code execution, database manipulation, or authentication bypass. The vulnerability requires the presence of exploitable gadget chains in the WordPress environment, which may include classes from WordPress core, active plugins, or the vulnerable plugin itself.
RemediationAI
Update MetaSlider Responsive Slider plugin to version 3.106.1 or later if available (fixed version not explicitly confirmed in provided data-verify with vendor advisory at Patchstack reference URL https://patchstack.com/database/wordpress/plugin/ml-slider/vulnerability/wordpress-responsive-slider-by-metaslider-plugin-3-106-0-php-object-injection-vulnerability). As interim mitigation, restrict WordPress admin access to trusted IP addresses only via .htaccess or firewall rules (trade-off: may block legitimate remote admin access), enforce strong password policies and mandatory two-factor authentication for all administrator accounts (reduces risk of credential compromise that enables exploitation), audit existing administrator accounts and remove unnecessary elevated privileges following principle of least privilege (limits attack surface but requires ongoing access review), and monitor WordPress admin activity logs for unexpected serialize/unserialize operations or plugin configuration changes (detection-focused, does not prevent exploitation). If the plugin functionality is non-critical, consider temporary deactivation until patch confirmation, though this eliminates slider functionality entirely.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-24075
GHSA-pccm-93c8-h8qm