The Smart Post Show plugin for WordPress is vulnerable to PHP Object Injection through the import_shortcodes() function, which deserializes untrusted input. Authenticated users with Administrator or higher privileges can craft input to instantiate malicious PHP objects. However, the plugin contains no built‑in Proxy‑Object‑Pattern (POP) chain, so the vulnerability alone does not enable arbitrary code execution. If the site also uses a plugin or theme that contains a POP chain, the attacker could delete files, retrieve confidential information, or execute arbitrary code depending on that chain’s capabilities.

Vendor ShapePlugin’s Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin, all versions up to and including 3.0.12 are affected. No other versions are listed as vulnerable.

The CVSS score of 7.2 indicates a moderate to high severity. Exploitation requires Administrator‑level access, meaning an attacker must already have authenticated session or credentials to the WordPress site. The EPSS score is unavailable and the vulnerability is not catalogued in KEV. Attackers with site admin privileges can inject objects; if a POP chain is present elsewhere on the system, the consequences may include file manipulation, data theft, or code execution. The risk is mitigated only if the site runs a later plugin version without the vulnerability or lacks a compatible POP chain.