CVE-2024-1859: 
WordPress vulnerability analysis and mitigation

The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-1859) affecting all versions up to and including 1.3.8. The vulnerability exists in the awl_slider_responsive_shortcode function through deserialization of untrusted input. This security issue was disclosed in March 2024 and affects the WordPress plugin specifically (NVD).

The vulnerability stems from improper handling of deserialization in the awl_slider_responsive_shortcode function. The CVSS v3.1 base score is 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. While no known POP (Property Oriented Programming) chain is present in the vulnerable plugin itself, the vulnerability could be exploited if a POP chain exists via additional plugins or themes installed on the target system (NVD).

If successfully exploited, this vulnerability could allow authenticated attackers with contributor-level access or higher to inject PHP Objects. When combined with a POP chain from other installed plugins or themes, this could lead to arbitrary file deletion, sensitive data retrieval, or code execution on the affected system (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring no user interaction to execute. Currently, there are no known POP chains present in the vulnerable plugin itself, though the risk increases if other plugins or themes provide viable POP chains (NVD).

Users should update to a version newer than 1.3.8 if available. If updates are not possible, consider removing the plugin or restricting access to users with contributor-level permissions and above (NVD).