{"id":"CVE-2026-78527","kind":"vulnerability","aliases":["CVE-2026-78527"],"related":[],"title":"GS Testimonial Slider WordPress plugin: PHP object injection by contributors","description":"Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.","summary":"The GS Testimonial Slider WordPress plugin, versions up to 3.3.10, has a PHP object injection flaw reachable by users with the Contributor role. The sources say an attacker with that role can inject serialized PHP objects, which can lead to code execution depending on the site's other code.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","wordpress","wordpress-plugin"],"not_affected_if":["no-contributor-accounts","plugin-newer-than-3.3.10","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get gs-testimonial-slider --field=version` (plugin slug assumed; unknown from sources).\n- Confirm whether any user accounts hold the Contributor role.","fix":"- GS Testimonial Slider: move to a version later than `3.3.10` (the fixed version is not stated in the sources).","status":"open","published_at":"2026-10-30T19:19:12+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:25:50+00:00","updated_at":"2026-10-30T19:25:50+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:25:50Z","model":"claude-haiku-5-5","output":{"fix":"- GS Testimonial Slider: move to a version later than `3.3.10` (the fixed version is not stated in the sources).","reach":"internet","title":"GS Testimonial Slider WordPress plugin: PHP object injection by contributors","impact":"high","summary":"The GS Testimonial Slider WordPress plugin, versions up to 3.3.10, has a PHP object injection flaw reachable by users with the Contributor role. The sources say an attacker with that role can inject serialized PHP objects, which can lead to code execution depending on the site's other code.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker injects serialized PHP objects, possibly running code on the server","analyst_note":"Confirm the fixed plugin version and the exact exploit path from the NVD entry or the plugin vendor's changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-78527.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get gs-testimonial-slider --field=version` (plugin slug assumed; unknown from sources).\n- Confirm whether any user accounts hold the Contributor role.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-newer-than-3.3.10","no-contributor-accounts"],"who_is_affected":"Sites running the GS Testimonial Slider plugin at version 3.3.10 or earlier. The flaw needs a logged-in account with the Contributor role, so sites with no contributor accounts are lower risk. The sources do not say whether default configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4056,"output_tokens":659,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-78527':13A,16A '3.3.10':32B,80C 'attack':50B 'code':63B,71B 'contributor':10A,44B,72C 'cve':11A,14A 'depend':65B 'execut':64B 'flaw':38B 'gs':1A,24B,77C 'inject':8A,37B,55B,75C 'lead':61B 'object':7A,36B,58B,74C 'packag':17B 'php':6A,18B,35B,57B,73C 'plugin':5A,22B,28B 'reachabl':39B 'role':45B,53B 'say':48B 'serial':56B 'site':68B 'slider':3A,26B,79C 'sourc':47B 'testimoni':2A,25B,78C 'user':41B 'version':29B,81C 'wordpress':4A,19B,21B,27B 'wordpress-plugin':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the GS Testimonial Slider plugin at version 3.3.10 or earlier. The flaw needs a logged-in account with the Contributor role, so sites with no contributor accounts are lower risk. The sources do not say whether default configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:19:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78527","severity":null,"published_at":"2026-10-30T19:19:12+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}