# Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation <= 3.8.9 - Authenticated (Contributor+) PHP Object Injection via Asset Cache Post Meta

- **ID:** WPSEC-2026-1713
- **Plugin:** Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation (`gs-logo-slider`), https://wordpress.org/plugins/gs-logo-slider/
- **Affected versions:** all versions before 3.9.0
- **Fixed in:** 3.9.0 (Update to 3.9.0 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gs-logo-slider
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1713/

## Description

The Logo Slider plugin for WordPress is vulnerable to PHP Object Injection via the asset cache post meta ('gsp--gs-logo-slider--assets') in all versions up to, and including, 3.8.9, due to deserialization of untrusted input. The meta value is passed to maybe_unserialize() without restricting allowed classes when a post is viewed on the front end, and the meta key is not protected, so a user who can edit a post can set it as a custom field. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP object. No known POP chain is present in the vulnerable plugin; if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-1713/
- https://plugins.svn.wordpress.org/gs-logo-slider/tags/3.9.0/
- https://wordpress.org/plugins/gs-logo-slider/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1713/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.