# Testimonial Slider <= 3.0.2 - Authenticated (Contributor+) PHP Object Injection via Shortcode Style Settings

- **ID:** WPSEC-2026-2875
- **Plugin:** Testimonial – Testimonial Slider and Showcase Plugin (`testimonial-slider-and-showcase`), https://wordpress.org/plugins/testimonial-slider-and-showcase/
- **Affected versions:** from 2.0.0 before 3.0.3
- **Fixed in:** 3.0.3 (Update to 3.0.3 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/testimonial-slider-and-showcase
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2875/

## Description

The Testimonial plugin for WordPress is vulnerable to PHP Object Injection via the rt-testimonial shortcode's style settings in all versions up to, and including, 3.0.2, due to the raw tss_* style post meta values being passed to unserialize() without restrictions, combined with the shortcode accepting the ID of a post of any post type instead of only its own shortcode post type. This makes it possible for authenticated attackers, with contributor-level access and above, to store a crafted value in a tss_* custom field on a post they can edit and render it through the shortcode, injecting a PHP object. No known POP chain is present in the vulnerable software itself. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-2875/
- https://plugins.svn.wordpress.org/testimonial-slider-and-showcase/tags/3.0.3/
- https://wordpress.org/plugins/testimonial-slider-and-showcase/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2875/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.