CVE-2024-1951 is a deserialization vulnerability (CWE-502) in the Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid WordPress plugin (versions up to 1.3.8). It allows authenticated users with contributor or higher privileges to inject PHP objects via shortcode input. The plugin itself does not include a PHP Object Injection gadget chain, but if other plugins or themes installed on the same WordPress instance provide such chains, attackers could leverage this to delete arbitrary files, retrieve sensitive information, or execute code. The vulnerability is network exploitable with low privileges but requires authentication. The CVSS 3.1 score is 7.5, indicating high severity.

An attacker with contributor or higher access can inject PHP objects through shortcode deserialization. Without a gadget chain in the vulnerable plugin, direct exploitation is limited. However, if other plugins or themes on the target system provide gadget chains, this vulnerability could lead to arbitrary file deletion, sensitive data disclosure, or remote code execution. This elevates the risk significantly in environments with multiple plugins or themes installed.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict contributor-level access and above to trusted users only. Review installed plugins and themes for known gadget chains that could be exploited in combination with this vulnerability. Consider disabling or removing the vulnerable plugin until a fix is released.