The MetaSlider Responsive Slider plugin is vulnerable to object injection, which could allow an attacker with administrative privileges to achieve remote code execution.

This is a deserialization of untrusted data flaw (CWE-502) that permits PHP object injection. According to the CVSS vector, this vulnerability requires high privileges (PR:H) to exploit, meaning an authenticated administrative user is necessary to trigger the flaw.

Successful exploitation of this vulnerability can lead to a complete compromise of the affected WordPress site. Given the CVSS score of 7.2, this represents a high-severity risk that could result in unauthorized code execution, full data loss, or total system takeover.

Immediate Action: Update the WordPress Responsive Slider by MetaSlider plugin to version 3.107.0 or higher immediately to apply the vendor-supplied fix.

Proactive Monitoring: Review server and WordPress access logs for unusual administrative activity or requests that appear to be passing serialized PHP objects to plugin endpoints.

Compensating Controls: Ensure that administrative access to the WordPress dashboard is strictly limited to authorized personnel and protected by multi-factor authentication to prevent unauthorized exploitation of this flaw.

Public Exploit Available: Unknown.

Organizations utilizing the MetaSlider Responsive Slider plugin must prioritize updating to version 3.107.0 or newer. Failure to patch this vulnerability leaves the environment susceptible to administrative-level compromise, and immediate action is required to maintain the security posture of the host application.