Technical impact
The WordPress Testimonial Slider plugin by Mamunur Rashid performs deserialization of data supplied by users without proper validation, which enables PHP Object Injection. An attacker can craft serialized payloads that, when processed by the plugin, instantiate arbitrary PHP objects and potentially execute malicious code. This flaw threatens the confidentiality, integrity, and availability of the WordPress site and any data stored or processed by the plugin. The weakness is categorized under CWE-502, reflecting improper handling of serialized data.
Affected Systems
All WordPress installations running Testimonial Slider version 3.0.2 or earlier are affected. The plugin version history starts from an undefined initial release through 3.0.2, so any active installation using those versions falls within the affected range.
Risk and Exploitability
The CVSS score of 8.8 classifies this vulnerability as high severity, indicating that exploitation could lead to significant damage. The exploitability information (EPSS) is not available, and the vulnerability is not listed in CISA's KEV catalog. Based on the nature of the flaw, the likely attack vector is remote via an HTTP request that provides serialized user input to the plugin. Attacks would require an attacker to inject a specially crafted payload; no special privileges are required beyond access to the vulnerable input endpoint.
