PHP Object Injection in MetaSlider Slideshow Import

MetaSlider up to 3.94.0 passes meta values from an imported slideshow file to unserialize() without restricting classes. A crafted import file can inject arbitrary PHP objects, which can lead to remote code execution, file deletion or data theft when a suitable POP chain is present on the site.

This vulnerability affects the following application versions:

• Slider, Gallery, and Carousel by MetaSlider 3.18.0
• Slider, Gallery, and Carousel by MetaSlider 3.18.1
• Slider, Gallery, and Carousel by MetaSlider 3.18.2
• Slider, Gallery, and Carousel by MetaSlider 3.18.3
• Slider, Gallery, and Carousel by MetaSlider 3.18.4
• Slider, Gallery, and Carousel by MetaSlider 3.18.5
• Slider, Gallery, and Carousel by MetaSlider 3.18.6
• Slider, Gallery, and Carousel by MetaSlider 3.18.7
• Slider, Gallery, and Carousel by MetaSlider 3.18.8
• Slider, Gallery, and Carousel by MetaSlider 3.18.9
• Slider, Gallery, and Carousel by MetaSlider 3.19.0
• Slider, Gallery, and Carousel by MetaSlider 3.19.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.0
• Slider, Gallery, and Carousel by MetaSlider 3.20.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.2
• Slider, Gallery, and Carousel by MetaSlider 3.20.3
• Slider, Gallery, and Carousel by MetaSlider 3.21.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.0
• Slider, Gallery, and Carousel by MetaSlider 3.23.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.2
• Slider, Gallery, and Carousel by MetaSlider 3.23.3
• Slider, Gallery, and Carousel by MetaSlider 3.23.4
• Slider, Gallery, and Carousel by MetaSlider 3.23.5
• Slider, Gallery, and Carousel by MetaSlider 3.24.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.1
• Slider, Gallery, and Carousel by MetaSlider 3.25.2
• Slider, Gallery, and Carousel by MetaSlider 3.26.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.1
• Slider, Gallery, and Carousel by MetaSlider 3.27.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.4
• Slider, Gallery, and Carousel by MetaSlider 3.27.5
• Slider, Gallery, and Carousel by MetaSlider 3.27.6
• Slider, Gallery, and Carousel by MetaSlider 3.27.7
• Slider, Gallery, and Carousel by MetaSlider 3.27.8
• Slider, Gallery, and Carousel by MetaSlider 3.27.9
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.10
• Slider, Gallery, and Carousel by MetaSlider 3.27.11
• Slider, Gallery, and Carousel by MetaSlider 3.27.12
• Slider, Gallery, and Carousel by MetaSlider 3.27.13
• Slider, Gallery, and Carousel by MetaSlider 3.27.14
• Slider, Gallery, and Carousel by MetaSlider 3.28.0
• Slider, Gallery, and Carousel by MetaSlider 3.28.1
• Slider, Gallery, and Carousel by MetaSlider 3.28.2
• Slider, Gallery, and Carousel by MetaSlider 3.28.3
• Slider, Gallery, and Carousel by MetaSlider 3.29.0
• Slider, Gallery, and Carousel by MetaSlider 3.29.1
• Slider, Gallery, and Carousel by MetaSlider 3.30.0
• Slider, Gallery, and Carousel by MetaSlider 3.30.1
• Slider, Gallery, and Carousel by MetaSlider 3.31.0
• Slider, Gallery, and Carousel by MetaSlider 3.32.0
• Slider, Gallery, and Carousel by MetaSlider 3.33.0
• Slider, Gallery, and Carousel by MetaSlider 3.34.0
• Slider, Gallery, and Carousel by MetaSlider 3.35.0
• Slider, Gallery, and Carousel by MetaSlider 3.36.0
• Slider, Gallery, and Carousel by MetaSlider 3.37.0
• Slider, Gallery, and Carousel by MetaSlider 3.40.0
• Slider, Gallery, and Carousel by MetaSlider 3.50.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.1
• Slider, Gallery, and Carousel by MetaSlider 3.61.0
• Slider, Gallery, and Carousel by MetaSlider 3.62.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.1
• Slider, Gallery, and Carousel by MetaSlider 3.70.2
• Slider, Gallery, and Carousel by MetaSlider 3.80.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.1
• Slider, Gallery, and Carousel by MetaSlider 3.91.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.1
• Slider, Gallery, and Carousel by MetaSlider 3.93.0
• Slider, Gallery, and Carousel by MetaSlider 3.94.0