MetaSlider 3.95.0 to 3.106.0 still passes the imported slideshow settings to WordPress core maybe_unserialize() without restricting classes, so an object nested inside a serialized array bypasses the import check. An Editor who can import slideshows can inject PHP objects with a crafted import file, which can lead to code execution when a suitable POP chain is present on the site.
This vulnerability affects the following application versions:
- Slider, Gallery, and Carousel by MetaSlider 3.95.0
- Slider, Gallery, and Carousel by MetaSlider 3.96.0
- Slider, Gallery, and Carousel by MetaSlider 3.97.0
- Slider, Gallery, and Carousel by MetaSlider 3.98.0
- Slider, Gallery, and Carousel by MetaSlider 3.99.0
- Slider, Gallery, and Carousel by MetaSlider 3.100.0
- Slider, Gallery, and Carousel by MetaSlider 3.100.1
- Slider, Gallery, and Carousel by MetaSlider 3.101.0
- Slider, Gallery, and Carousel by MetaSlider 3.102.0
- Slider, Gallery, and Carousel by MetaSlider 3.103.0
- Slider, Gallery, and Carousel by MetaSlider 3.104.0
- Slider, Gallery, and Carousel by MetaSlider 3.105.0
- Slider, Gallery, and Carousel by MetaSlider 3.106.0