WordPress PHP Object Injection Hits Smart Post Show Plugin

A critical PHP Object Injection vulnerability, tracked as CVE-2026-3017, has been identified in the Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress. According to the National Vulnerability Database, all versions up to and including 3.0.12 are susceptible due to insecure deserialization of untrusted input within the import_shortcodes() function. This flaw allows authenticated attackers with Administrator-level access or higher to inject a PHP Object.

While the vulnerability itself, with a CVSS score of 7.2 (HIGH), requires high privileges, its true danger lies in the potential presence of a Property-Oriented Programming (POP) chain. The National Vulnerability Database notes that no known POP chain exists within the vulnerable plugin itself. However, if another plugin or theme installed on the target WordPress site contains a POP chain, this vulnerability could be escalated significantly. Such a combination might enable an attacker to perform severe actions, including arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on the specific POP chain available.