CVE-2024-1859
First published: Fri Mar 01 2024(Updated: )
The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization of untrusted input to the awl_slider_responsive_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Slider Responsive Slideshow | <=1.3.8 | |
| Slider Responsive Slideshow | <1.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1859?
CVE-2024-1859 is considered a high severity vulnerability due to the risk of PHP Object Injection.
How do I fix CVE-2024-1859?
To fix CVE-2024-1859, update the Slider Responsive Slideshow plugin to version 1.3.9 or later.
Who is affected by CVE-2024-1859?
All users of the Slider Responsive Slideshow Image slider, Gallery slideshow plugin for WordPress up to version 1.3.8 are affected by CVE-2024-1859.
What type of vulnerability is CVE-2024-1859?
CVE-2024-1859 is a PHP Object Injection vulnerability resulting from the deserialization of untrusted input.
Can unauthenticated users exploit CVE-2024-1859?
No, CVE-2024-1859 requires authentication, meaning only authenticated users can potentially exploit the vulnerability.
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/slider responsive slideshow
- canonical/slider responsive slideshow
- vendor/awplife