A deserialization flaw in the Slider by 10Web plugin enables an attacker to inject arbitrary PHP objects into the application. The vulnerability arises from handling untrusted data during object deserialization, which can be exploited to manipulate object states and trigger malicious behavior, potentially allowing remote code execution or unauthorized data modification.

The issue affects the WordPress Slider by 10Web plugin, specifically any installation at version 1.2.62 or earlier. Any WordPress site that has not upgraded past version 1.2.63 remains vulnerable.

The vulnerability carries a CVSS score of 8.8, indicating a high severity level. No EPSS score is available, and the flaw is not yet listed in CISA KEV, suggesting current exploitation prevalence is uncertain. The likely attack vector is a web request that passes crafted payloads to the plugin’s deserialization routine, a common surface for attackers seeking remote code execution.