CVE-2026-3017 is a PHP Object Injection vulnerability in the Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts WordPress plugin (up to version 3.0.12). It arises from unsafe deserialization of untrusted data in the import_shortcodes() function. The vulnerability requires authenticated users with Administrator privileges to inject malicious PHP objects. However, exploitation impact depends on the presence of a gadget POP chain in other installed plugins or themes, as no such chain exists within this plugin alone. If a suitable POP chain is present, attackers may perform destructive or unauthorized actions such as deleting files, accessing sensitive information, or executing arbitrary code.

An attacker with Administrator-level access can inject PHP objects via deserialization, potentially leading to arbitrary code execution, file deletion, or data disclosure if a suitable POP chain exists in other installed plugins or themes. Without such a POP chain, this vulnerability has no direct impact. The CVSS score of 7.2 reflects high confidentiality, integrity, and availability impacts contingent on the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and audit installed plugins and themes for known POP chains that could be leveraged. Monitor vendor channels for updates or patches addressing this vulnerability.