Object-Injection — CraftedSignal Threat Feed

MetaSlider Responsive Slider Plugin Deserialization Vulnerability (CVE-2026-39467)

hello@craftedsignal.io — Tue, 21 Apr 2026 10:16:29 +0000

CVE-2026-39467 is a critical vulnerability affecting the MetaSlider Responsive Slider plugin for WordPress. Specifically, it is a Deserialization of Untrusted Data vulnerability that can lead to Object Injection. The vulnerability exists in versions up to and including 3.106.0. An attacker can exploit this vulnerability to inject arbitrary PHP objects into the application, potentially leading to remote code execution. This is possible because the plugin deserializes data without proper validation, allowing malicious actors to manipulate serialized data and inject harmful objects. The vulnerability was reported by Patchstack. Given the widespread use of WordPress and the MetaSlider plugin, this vulnerability poses a significant risk to a large number of websites.

Attack Chain

Attacker sends a crafted HTTP request to a WordPress endpoint that processes MetaSlider plugin data.
The request contains a serialized PHP object designed for malicious purposes.
The MetaSlider plugin deserializes the untrusted data without proper sanitization or validation using unserialize().
The deserialization process instantiates the malicious PHP object.
The injected object executes its malicious payload, potentially writing files to the server.
The attacker leverages the file write capability to plant a PHP webshell in the WordPress uploads directory.
The attacker accesses the webshell via a direct HTTP request.
The attacker executes arbitrary commands on the server via the webshell, gaining full control.

Impact

Successful exploitation of CVE-2026-39467 allows an unauthenticated attacker to inject arbitrary PHP objects, leading to remote code execution on the target WordPress server. This could result in complete compromise of the website, including data theft, defacement, or further attacks on internal networks. Given the popularity of MetaSlider, potentially thousands of websites are vulnerable.

Recommendation

Upgrade the MetaSlider Responsive Slider plugin to the latest version to patch CVE-2026-39467.
Implement the Sigma rule Detect MetaSlider Object Injection Attempt to detect exploitation attempts in web server logs.
Monitor web server logs for suspicious POST requests containing serialized PHP objects to WordPress endpoints.

Smart Post Show WordPress Plugin PHP Object Injection Vulnerability

hello@craftedsignal.io — Tue, 14 Apr 2026 06:17:10 +0000

The Smart Post Show WordPress plugin, specifically the Post Grid, Post Carousel & Slider, and List Category Posts components, contains a PHP Object Injection vulnerability. This flaw affects all versions up to and including 3.0.12. The vulnerability resides in the import_shortcodes() function, where the deserialization of untrusted input occurs. This vulnerability requires an authenticated attacker with administrative privileges or higher. Successful exploitation requires the presence of a suitable Property-Oriented Programming (POP) chain within another installed plugin or theme. Without a POP chain, the injected object has no immediate impact. However, with a POP chain, attackers can potentially delete arbitrary files, retrieve sensitive data, or execute arbitrary code on the server.

Attack Chain

An attacker gains administrative-level access to the WordPress dashboard, either through credential compromise or vulnerability exploitation.
The attacker navigates to the Smart Post Show plugin settings page within the WordPress admin panel.
The attacker crafts a malicious payload containing a serialized PHP object designed to trigger a POP chain.
The attacker injects the malicious payload into the import_shortcodes() function, likely through a form field or file upload.
The import_shortcodes() function deserializes the attacker-controlled input, creating the malicious PHP object.
If a suitable POP chain exists within other installed plugins or themes, the deserialization triggers the chain.
The POP chain executes a series of predefined actions based on the objects and methods involved.
The final objective is achieved, such as deleting arbitrary files, retrieving sensitive data, or executing arbitrary code on the server.

Impact

The PHP Object Injection vulnerability in the Smart Post Show WordPress plugin allows attackers to potentially gain remote code execution on the affected server. The impact is contingent on the existence of a POP chain within other installed plugins or themes. If successful, an attacker could potentially compromise the entire web server, leading to data breaches, defacement, or complete system takeover. Given the widespread use of WordPress and this plugin, a successful exploit could affect numerous websites across various sectors.

Recommendation

Upgrade the Smart Post Show plugin to a version greater than 3.0.12 to patch CVE-2026-3017.
Deploy the Sigma rule “Detect WordPress Plugin Deserialization Attempt” to monitor for suspicious deserialization activity on WordPress servers.
Audit all installed WordPress plugins and themes for potential POP chains that could be exploited in conjunction with this vulnerability.

Everest Forms WordPress Plugin PHP Object Injection Vulnerability

hello@craftedsignal.io — Wed, 08 Apr 2026 02:16:04 +0000

The Everest Forms plugin for WordPress, a widely used form builder, contains a critical PHP Object Injection vulnerability (CVE-2026-3296) affecting versions up to and including 3.4.3. This vulnerability stems from the insecure deserialization of user-supplied data within the html-admin-page-entries-view.php file. Specifically, the plugin uses PHP’s unserialize() function on form entry metadata stored in the wp_evf_entrymeta table without specifying allowed classes, creating an exploitable condition. An unauthenticated attacker can inject malicious serialized PHP objects through any public form field. The sanitize_text_field() function fails to prevent these attacks because it doesn’t strip serialization control characters. This allows attackers to execute arbitrary PHP code on the WordPress server when an administrator views form entries. This vulnerability poses a significant risk to WordPress sites using the Everest Forms plugin.

Attack Chain

An unauthenticated attacker submits a malicious serialized PHP object through a public Everest Forms form field.
The submitted payload bypasses the sanitize_text_field() function due to the function’s failure to remove serialization control characters.
The crafted serialized object is stored in the wp_evf_entrymeta database table associated with the form entry.
An administrator accesses the WordPress administration panel and navigates to the Everest Forms entries section.
The html-admin-page-entries-view.php file is executed to display form entries and their associated metadata.
The plugin retrieves the stored serialized object from the wp_evf_entrymeta table.
The unserialize() function is called on the retrieved data without the allowed_classes parameter, triggering PHP Object Injection.
The injected PHP object is instantiated, leading to arbitrary PHP code execution on the server, potentially granting the attacker complete control over the WordPress site.

Impact

Successful exploitation of this vulnerability (CVE-2026-3296) can lead to complete compromise of the WordPress website. An attacker can gain remote code execution, allowing them to inject malware, deface the site, steal sensitive data (including user credentials and financial information), or use the compromised server as part of a botnet. Given the widespread use of the Everest Forms plugin, a large number of WordPress sites are potentially vulnerable. The CVSS v3.1 base score of 9.8 reflects the critical severity of this vulnerability.

Recommendation

Immediately update the Everest Forms plugin to the latest version (greater than 3.4.3) to patch CVE-2026-3296.
Deploy the Sigma rule Detect Suspicious unserialize Call in Everest Forms to identify potential exploitation attempts in web server logs.
Monitor web server logs for suspicious POST requests to WordPress form submission endpoints containing serialized PHP objects, as detected by the Detect Suspicious Form Submission with Serialized Data Sigma rule.
Implement a Web Application Firewall (WAF) rule to block requests containing serialized PHP objects in form submission data.