Technical impact
The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data. An attacker who can provide crafted serialized payloads to the plugin can instantiate arbitrary PHP objects, potentially leading to remote code execution or other destructive behaviors. The weakness is categorized as CWE‑502, where the application allows the creation of unintended objects via deserialization.
Affected Systems
The affected product is "A WP Life: Slider Responsive Slideshow – Image slider, Gallery slideshow". Versions from the earliest available release up to and including 1.5.4 are vulnerable. The specific affected versions are not enumerated beyond the upper bound of 1.5.4.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity. The EPSS score is below 1%, showing a low but nonzero exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would most likely exploit the flaw by sending malicious serialized data through the plugin’s web interfaces, such as POST requests or specially crafted URLs, leveraging the plugin’s lack of input validation. Given the high impact and high score, the risk is significant for any site running the vulnerable plugin without mitigation.
