CVE-2026-39467
Published: 21 April 2026
Summary
CVE-2026-39467 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-39467 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the MetaSlider Responsive Slider plugin for WordPress, developed by MetaSlider. The flaw enables Object Injection and affects all versions of the plugin from n/a through 3.106.0. Published on 2026-04-21, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited over the network by authenticated attackers with high privileges, such as WordPress administrators, requiring low attack complexity and no user interaction. Successful exploitation allows attackers to achieve high levels of impact on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or other severe compromises within the affected WordPress environment.
The primary advisory from Patchstack (https://patchstack.com/database/wordpress/plugin/ml-slider/vulnerability/wordpress-responsive-slider-by-metaslider-plugin-3-106-0-php-object-injection-vulnerability?_s_id=cve) documents the PHP Object Injection vulnerability in Responsive Slider by MetaSlider version 3.106.0. Mitigation requires updating the plugin to a version beyond 3.106.0 where the issue is addressed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24075
Vulnerability details
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a deserialization/object injection vulnerability in a public-facing WordPress plugin exploitable over the network by authenticated high-privilege users, directly enabling exploitation of public-facing applications leading to arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the deserialization vulnerability by updating the MetaSlider plugin beyond version 3.106.0.
Prevents object injection by enforcing validation and sanitization of untrusted inputs prior to deserialization in the WordPress plugin.
Minimizes risk by restricting the WordPress environment to least functionality, such as disabling or removing unnecessary vulnerable plugins like MetaSlider.