Testimonial Slider <= 3.0.2 - Authenticated (Contributor+) PHP Object Injection via Shortcode Style Settings
- ID
- WPSEC-2026-2875
- Plugin
- Testimonial – Testimonial Slider and Showcase Plugin (testimonial-slider-and-showcase)
- Affected
- from 2.0.0 before 3.0.3
- Remediation
- Update to 3.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Testimonial Slider on WPSec AttackSurface
- Fix released
- Published
Description
The Testimonial plugin for WordPress is vulnerable to PHP Object Injection via the rt-testimonial shortcode's style settings in all versions up to, and including, 3.0.2, due to the raw tss_* style post meta values being passed to unserialize() without restrictions, combined with the shortcode accepting the ID of a post of any post type instead of only its own shortcode post type. This makes it possible for authenticated attackers, with contributor-level access and above, to store a crafted value in a tss_* custom field on a post they can edit and render it through the shortcode, injecting a PHP object. No known POP chain is present in the vulnerable software itself. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-2875/
- https://plugins.svn.wordpress.org/testimonial-slider-and-showcase/tags/3.0.3/
- https://wordpress.org/plugins/testimonial-slider-and-showcase/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS