A PHP Object Injection vulnerability in the JS Archive List plugin for WordPress allows authenticated attackers with Contributor access to achieve remote code execution if a suitable POP chain is present.

The plugin fails to safely handle deserialization of untrusted input provided through the included shortcode attribute. This vulnerability requires the attacker to have at least Contributor-level authenticated access to the WordPress environment to trigger the insecure deserialization process.

While the base CVSS score is 7.5, the impact is highly dependent on the environment. If the target system contains additional plugins or themes that provide a functional POP chain, an attacker could escalate this to arbitrary file deletion, sensitive data exfiltration, or remote code execution. This poses a significant risk to the integrity and confidentiality of the entire WordPress installation.

Immediate Action: Update the JS Archive List plugin to version 6.1.8 or higher, where the insecure deserialization has been addressed.

Proactive Monitoring: Monitor WordPress audit logs for unusual shortcode usage or attempts by low-privileged user accounts to modify plugin settings or configuration parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing serialized PHP objects in shortcode parameters. Remove the plugin entirely if the functionality is not critical to business operations.

Public Exploit Available: Unknown.

The vulnerability represents a significant security risk due to the potential for remote code execution. Administrators should verify their plugin version immediately and apply the update provided by the vendor. In environments where high-security standards are required, consider replacing the plugin with a more robust alternative that does not utilize insecure deserialization patterns.