This vulnerability in PickPlugins Testimonial Slider allows an attacker with at least low privileges to exploit deserialization of untrusted data, resulting in object injection. The affected versions are from an unspecified initial version through 2.0.13. The CVSS 3.1 score of 8.8 reflects network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been provided yet.

Successful exploitation could allow an attacker to execute arbitrary code or manipulate application behavior through object injection, leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires at least low privileges but no user interaction, making it a serious threat if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to deserialization processes. Avoid processing untrusted serialized data where possible.