---
id: "CVE-2026-78527"
kind: "vulnerability"
aliases: ["CVE-2026-78527"]
title: "GS Testimonial Slider WordPress plugin: PHP object injection by contributors"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-contributor-accounts", "plugin-newer-than-3.3.10", "plugin-not-installed"]
published_at: "2026-10-30T19:19:12+00:00"
first_seen_at: "2026-10-30T19:25:30+00:00"
updated_at: "2026-10-30T19:25:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78527", "first_seen_at": "2026-10-30T19:25:30+00:00"}]
---

# GS Testimonial Slider WordPress plugin: PHP object injection by contributors

The GS Testimonial Slider WordPress plugin, versions up to 3.3.10, has a PHP object injection flaw reachable by users with the Contributor role. The sources say an attacker with that role can inject serialized PHP objects, which can lead to code execution depending on the site's other code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get gs-testimonial-slider --field=version` (plugin slug assumed; unknown from sources).
- Confirm whether any user accounts hold the Contributor role.

## Fix

- GS Testimonial Slider: move to a version later than `3.3.10` (the fixed version is not stated in the sources).

## Timeline

- 2026-10-30T19:25:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78527

## From the sources

Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_