Responsive Slider Gallery
Monthly
PHP object injection in the Responsive Slider Gallery WordPress plugin (versions up to and including 1.5.5) lets an authenticated Editor-level user pass crafted serialized data into an unsafe unserialize() call, potentially triggering arbitrary object instantiation and, given a usable POP gadget chain, file manipulation or remote code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) confirms network reachability and full confidentiality, integrity, and availability impact, but the high-privilege prerequisite excludes anonymous or subscriber-level attackers. No public exploit code has been identified at time of analysis and the vulnerability is not reported as actively exploited (no CISA KEV entry); the plugin's limited deployment footprint further narrows the exposed population.
PHP object injection in the Responsive Slider Gallery WordPress plugin (versions up to and including 1.5.5) lets an authenticated Editor-level user pass crafted serialized data into an unsafe unserialize() call, potentially triggering arbitrary object instantiation and, given a usable POP gadget chain, file manipulation or remote code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) confirms network reachability and full confidentiality, integrity, and availability impact, but the high-privilege prerequisite excludes anonymous or subscriber-level attackers. No public exploit code has been identified at time of analysis and the vulnerability is not reported as actively exploited (no CISA KEV entry); the plugin's limited deployment footprint further narrows the exposed population.