CVE-2024-3020

HIGH

Carousel, Slider, Gallery by WP Carousel < 2.6.3 - Authenticated PHP Object Injection via Import Function

Title source: llm

Description

The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

References (2)

Core 2

Core References

Product

https://plugins.trac.wordpress.org/changeset/3065296/wp-carousel-free/trunk/includes/class-wp-carousel-free-import-export.php

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/d66df15e-1a0a-49e9-bcf9-67091499b24e?source=cve

Scores

CVSS v3 7.2

EPSS 0.0097

EPSS Percentile 57.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-502

Status published

Products (2)

shapedplugin/Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce < 2.6.3

shapedplugin/Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel < 2.6.3

Published Apr 10, 2024

Tracked Since Feb 18, 2026