CVE-2024-1950 is a high severity (CVSS 7.5) PHP object injection flaw in the Product Carousel Slider and Grid Ultimate for WooCommerce plugin, versions up to and including 1.9.7. Contributor level users can reach it through a shortcode. Update to 1.9.8 or later.
What's affected
The NVD record covers all versions up to and including 1.9.7 of the Product Carousel Slider and Grid Ultimate for WooCommerce plugin by WPWAX. Its references include a WordPress.org changeset that compares tag 1.9.7 with 1.9.8, which indicates the fix landed in 1.9.8. I could not retrieve that changeset or the Wordfence entry, so confirm the fixed version on the plugin page.
NVD scores it 7.5 (High) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The authenticated attacker needs contributor access or higher.
How to check if you're exposed
If you have WP-CLI, run wp plugin list and look for woo-product-carousel-slider-and-grid-ultimate in the output, or wp plugin get woo-product-carousel-slider-and-grid-ultimate and read the version row. Without it, open the Plugins screen in WordPress admin and read the version under the plugin name. Check every site you run, including staging copies and multisite networks.
Also review who has contributor rights on your sites. Sites with open registration or many guest authors carry the most exposure.
What to do now
- Update the plugin to 1.9.8 or later on every site.
- Review the list of contributor, author and editor accounts and remove those you do not recognize.
- Audit which other plugins and themes are installed, since the impact depends on them.
- If you cannot update, deactivate the plugin until you can.
- Turn on automatic plugin updates for low risk plugins.
Why it matters
The class is CWE-502, deserialization of untrusted input. The plugin passes user influenced data to PHP's unserialize function through shortcode handling. That lets an attacker create PHP objects of classes already loaded on the site.
The record says no POP chain is present in this plugin itself. A POP chain is a sequence of existing class methods that can be triggered by a crafted object. If another plugin or theme on the same site has one, the record says an attacker could delete arbitrary files, retrieve sensitive data or run code. So the real risk depends on the rest of your site, which is why the CVSS attack complexity is high. The fix is to avoid unserialize on user data and use JSON instead. The record's KEV flag is false, and no source I retrieved reports exploitation of this CVE in the wild. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the plugin alone enough to be exploited?
The record says no POP chain exists in the plugin. Another installed plugin or theme would have to supply one.
Who can exploit it?
Authenticated users with contributor access or above.
Sources
Last reviewed: 19 October 2026.
