What the vulnerability does
01Description
The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted input 'fsl_get_gallery_value' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Explanation of Vulnerability in Simple Terms
02Summary
Universal Slider versions up to 1.6.5 contain a deserialization vulnerability that allows authenticated users to read or modify sensitive data. An attacker with low-level site access can craft malicious serialized objects to bypass normal access controls. No code execution or availability impact occurs, but confidentiality and integrity are at risk.
What an attacker can do
03Attacker Capabilities
Read or modify sensitive data on the site by submitting malicious serialized objects.
Potential impact on your site
04Site Impact
Authenticated users with low privileges can access or alter data they should not be able to reach.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege authenticated account on the site.
Key dates
06Disclosure timeline
June 19, 2024
CVE published
April 8, 2026
Record updated
