The vulnerability CVE-2024-3020 is a PHP Object Injection issue classified under CWE-502, present in the shapedplugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider by WP Carousel plugin up to version 2.6.3. It arises from unsafe deserialization of untrusted input passed through the 'shortcode' parameter in the import function. An attacker with administrator privileges can inject malicious PHP objects. If a Property Oriented Programming (POP) chain is available through other installed plugins or themes, this can be leveraged to perform destructive or unauthorized actions such as arbitrary file deletion, data retrieval, or remote code execution. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An authenticated attacker with administrator-level access can exploit this vulnerability to inject PHP objects via deserialization, potentially leading to arbitrary file deletion, sensitive data exposure, or remote code execution if a suitable POP chain exists. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the import function and shortcode parameter. Avoid installing untrusted plugins or themes that could provide POP chains enabling exploitation.