CVE-2024-1950 is a deserialization vulnerability (CWE-502) in the Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress. It allows authenticated users with contributor or higher privileges to inject PHP objects via shortcode input. The plugin does not contain a POP chain internally, but exploitation is possible if other installed plugins or themes provide one, potentially leading to file deletion, data disclosure, or code execution. The vulnerability affects all versions up to and including 1.9.7. No patch or official fix has been documented in the provided data.

An attacker with contributor-level access or higher can exploit this vulnerability to inject PHP objects through shortcode deserialization. Without a POP chain in the plugin itself, direct exploitation is limited; however, if other plugins or themes on the same WordPress installation provide a POP chain, the attacker could achieve critical impacts including arbitrary file deletion, sensitive data retrieval, or remote code execution. This elevates the risk to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the vendor or security advisories for a patch or official mitigation.