The Smart Post Show plugin for WordPress contains a PHP Object Injection vulnerability that allows authenticated attackers with administrative access to potentially achieve remote code execution.

The vulnerability exists in the import_shortcodes() function, which fails to securely handle deserialization of untrusted input. An authenticated attacker with Administrator-level privileges can inject a malicious PHP Object, which may lead to arbitrary file deletion, data retrieval, or code execution if a compatible POP chain exists elsewhere in the environment.

Successful exploitation of this vulnerability poses a severe risk to the integrity and confidentiality of the WordPress installation. With a CVSS score of 7.2, the vulnerability is classified as High severity, as it enables an attacker who has already gained administrative access to escalate their capabilities to full system compromise, potentially leading to total loss of data or complete site takeover.

Immediate Action: Update the Smart Post Show plugin to the latest available version beyond 3.0.12 immediately to patch the deserialization flaw.

Proactive Monitoring: Review WordPress administrative activity logs for suspicious shortcode imports or unusual plugin configuration changes.

Compensating Controls: Ensure that administrative access to the WordPress dashboard is strictly limited to authorized personnel and utilize a Web Application Firewall to block suspicious serialized input patterns.

Public Exploit Available: No

Given the potential for remote code execution, it is imperative that administrators update the affected plugin as soon as a patch is confirmed available in the latest release. Organizations should verify their plugin inventory and apply updates across all affected WordPress environments to mitigate the risk of administrative account compromise leading to full system exploitation.