CVE-2026-3017

OVERVIEW CVE-2026-3017 is a PHP Object Injection vulnerability affecting the Smart Post Show plugin for WordPress (Post Grid, Post Carousel & Slider, and List Category Posts) in all versions up to 3.0.12. The flaw exists in the import_shortcodes() function and is triggered through deserialization of untrusted input, allowing authenticated attackers with Administrator-level access or above to inject malicious PHP objects. SEVERITY The vulnerability carries a CVSS score of 7.2 (HIGH) with a network-based attack vector, low complexity, and high privilege requirements. While the plugin itself contains no known gadget chain, the true risk depends on the presence of exploitable POP chains in other installed plugins or themes. If such chains exist, attackers could delete arbitrary files, exfiltrate sensitive data, or achieve remote code execution. The FAUCET Risk Score of 47.0/100 reflects this conditional severity. EXPLOITATION STATUS There is no evidence of active exploitation. The EPSS score of 0.0004 indicates this vulnerability ranks lower than 99.87 percent of all CVEs in terms of exploitation probability. The vulnerability is not on the KEV Catalog, and community attention appears limited. However, organizations should monitor for any POP chain gadgets that could be introduced through third-party plugins or themes, as such additions would significantly elevate risk.