CVE-2026-3017 is a PHP Object Injection vulnerability in the Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts WordPress plugin, affecting all versions up to 3.0.12. The issue arises from unsafe deserialization of untrusted input in the import_shortcodes() function. An attacker with Administrator privileges can inject PHP objects. However, exploitation requires a gadget POP chain from other installed plugins or themes to achieve impactful actions such as arbitrary file deletion, sensitive data access, or code execution. No known exploit chains exist within the plugin itself. The vulnerability has a CVSS 3.1 score of 7.2 (high severity). No official patch or vendor remediation information is currently provided.

If exploited in an environment where a suitable POP chain exists in other installed plugins or themes, an attacker with Administrator access could perform critical actions including arbitrary file deletion, sensitive data disclosure, or remote code execution. Without such a POP chain, the vulnerability has no practical impact. There are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Since exploitation requires Administrator-level access and the presence of a gadget POP chain in other plugins or themes, limiting plugin/theme installations to trusted sources and minimizing Administrator accounts can reduce risk. Monitor vendor advisories for updates or patches addressing this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.