{"id":"CVE-2026-125449","kind":"vulnerability","aliases":["CVE-2026-125449"],"related":[],"title":"WordPress Testimonial Slider plugin: untrusted data deserialization allows object injection","description":"Deserialization of Untrusted Data vulnerability in Mamunur Rashid Testimonial Slider testimonial-slider-and-showcase allows Object Injection.This issue affects Testimonial Slider: from n/a through 3.0.2.","summary":"The Testimonial Slider and Showcase WordPress plugin deserializes untrusted data, which allows PHP object injection. A successful attack can lead to code execution or data access depending on the classes available on the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"testimonial-slider-and-showcase","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","php","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the plugin `testimonial-slider-and-showcase` is installed and its version in the WordPress admin Plugins screen\n- Compare the installed version against the range stated in the NVD entry (through 3.0.2)","fix":"- Testimonial Slider: no fixed version stated in the sources; update to a release newer than 3.0.2 once the vendor publishes one","status":"open","published_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","triaged_at":"2026-11-15T14:37:22+00:00","updated_at":"2026-11-15T14:37:22+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-15T14:37:22Z","model":"claude-haiku-5-5","output":{"fix":"- Testimonial Slider: no fixed version stated in the sources; update to a release newer than 3.0.2 once the vendor publishes one","reach":"internet","title":"WordPress Testimonial Slider plugin: untrusted data deserialization allows object injection","impact":"high","summary":"The Testimonial Slider and Showcase WordPress plugin deserializes untrusted data, which allows PHP object injection. A successful attack can lead to code execution or data access depending on the classes available on the site.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker injects PHP objects, possibly running code on the server","analyst_note":"Confirm the fixed version and the attack prerequisites from the NVD entry or the plugin's WordPress.org changelog.","how_to_check":"- Check whether the plugin `testimonial-slider-and-showcase` is installed and its version in the WordPress admin Plugins screen\n- Compare the installed version against the range stated in the NVD entry (through 3.0.2)","plain_action":"","product_name":"testimonial-slider-and-showcase","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Testimonial Slider and Showcase WordPress plugin at version 3.0.2 or earlier. The sources do not state which configurations or user roles are needed to reach the vulnerable code path.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4548,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125449':13A,16A '-2026':12A,15A '3.0.2':87C 'access':53B 'affect':81C 'allow':8A,39B,77C 'and':20A 'attack':45B 'avail':58B 'class':57B 'code':49B 'cve':11A,14A 'data':6A,37B,52B,65C 'depend':54B 'deseri':7A,35B,62C 'execut':50B 'host':26B 'inject':10A,42B 'injection.this':79C 'issu':80C 'lead':47B 'mamunur':68C 'n/a':85C 'object':9A,41B,78C 'php':23B,40B 'plugin':4A,34B 'rashid':69C 'self':25B 'self-host':24B 'showcas':32B,76C 'showcase':21A 'site':61B 'slider':3A,19A,30B,71C,74C,83C 'success':44B 'testimoni':2A,29B,70C,73C,82C 'testimonial':18A 'testimonial-slider-and-showcas':72C 'testimonial-slider-and-showcase':17A 'untrust':5A,36B,64C 'vulner':66C 'wordpress':1A,27B,33B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Testimonial Slider and Showcase WordPress plugin at version 3.0.2 or earlier. The sources do not state which configurations or user roles are needed to reach the vulnerable code path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["testimonialsliderandshowcase"],"ptokens":["and","showcase","slider","testimonial"],"labels":["high","other","php","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-125449':13A,16A '-2026':12A,15A 'allow':8A 'and':20A 'cve':11A,14A 'data':6A 'deseri':7A 'inject':10A 'object':9A 'plugin':4A 'showcase':21A 'slider':3A,19A 'testimoni':2A 'testimonial':18A 'testimonial-slider-and-showcase':17A 'untrust':5A 'wordpress':1A","search_b":"'access':53B 'allow':39B 'attack':45B 'avail':58B 'class':57B 'code':49B 'data':37B,52B 'depend':54B 'deseri':35B 'execut':50B 'host':26B 'inject':42B 'lead':47B 'object':41B 'php':23B,40B 'plugin':34B 'self':25B 'self-host':24B 'showcas':32B 'site':61B 'slider':30B 'success':44B 'testimoni':29B 'untrust':36B 'wordpress':27B,33B","search_c":"'3.0.2':87C 'affect':81C 'allow':77C 'data':65C 'deseri':62C 'injection.this':79C 'issu':80C 'mamunur':68C 'n/a':85C 'object':78C 'rashid':69C 'showcas':76C 'slider':71C,74C,83C 'testimoni':70C,73C,82C 'testimonial-slider-and-showcas':72C 'untrust':64C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125449","severity":null,"published_at":"2026-11-15T14:17:24+00:00","modified_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","fetched_at":"2026-11-15T14:36:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}