The WP Posts Carousel plugin for WordPress, developed by teastudio.pl, contains a deserialization of untrusted data vulnerability (CVE-2025-39358) in versions up to 1.3.12. This vulnerability allows an attacker with at least low privileges to inject malicious objects during deserialization, potentially leading to full system compromise. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or manipulate application logic, resulting in full compromise of the affected WordPress site’s confidentiality, integrity, and availability. The vulnerability requires low privileges and no user interaction, making it a significant risk if exploited. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the plugin and limit privileges of users who can interact with it. Monitor official teastudio.pl channels for updates or fixes.