The Responsive Slideshow WordPress plugin (versions ≤ 1.3.8) is vulnerable to PHP Object Injection due to unsafe deserialization of untrusted input in the awl_slider_responsive_shortcode function. Authenticated users with contributor or higher privileges can inject PHP objects. Without a gadget chain in the plugin, exploitation is limited, but if other installed plugins or themes provide a POP chain, attackers could achieve critical impacts including file deletion, data leakage, or code execution. The vulnerability is tracked as CVE-2024-1859 with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Successful exploitation allows authenticated contributors or higher to inject PHP objects via deserialization, potentially leading to arbitrary file deletion, sensitive data exposure, or remote code execution if a suitable POP chain exists in the environment. The vulnerability poses a high risk due to the combination of network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or replacing the Responsive Slideshow plugin to reduce risk. Review installed plugins and themes for potential POP chains that could be leveraged in exploitation.