CVE-2024-2006 is a high severity (CVSS 8.8) PHP object injection flaw in the Post Grid, Slider and Carousel Ultimate plugin for WordPress, versions up to and including 1.6.7. Contributor level users can reach it. A changeset points to 1.6.8 as the fixed version.
What's affected
The NVD record covers all versions up to and including 1.6.7 of the Post Grid, Slider and Carousel Ultimate plugin by WPWAX. The vulnerable function is outpost_shortcode_metabox_markup. A referenced WordPress.org changeset compares tag 1.6.7 with 1.6.8, which indicates the fix is in 1.6.8. I could not retrieve it, so confirm on the plugin page.
NVD scores it 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Contributor access or above is required.
How to check if you're exposed
If you have WP-CLI, run wp plugin list and look for post-grid-carousel-ultimate in the output, or wp plugin get post-grid-carousel-ultimate and read the version row. Without it, open the Plugins screen in WordPress admin and read the version under the plugin name. Check every site you run, including staging copies and multisite networks.
Also check who holds contributor or higher roles. Each such account is a possible way in.
What to do now
- Update the plugin to 1.6.8 or later on every site.
- Remove unneeded contributor and author accounts and enforce strong passwords or two factor sign in for the rest.
- Review installed plugins and themes for others that may give attackers a useful class to abuse.
- If you cannot update, deactivate the plugin.
- Enable automatic updates where your change process allows it.
Why it matters
This is CWE-502, deserialization of untrusted input, in the metabox markup function. User controlled data reaches PHP's unserialize, so an attacker can instantiate objects of any class loaded in the request.
The record says that if a POP chain exists in another plugin or theme, the attacker could delete files, read sensitive data or run code. Here the CVSS impact is high on all three axes and attack complexity is low, which is why NVD scores it higher than the sibling flaw in the same vendor's Product Carousel plugin (CVE-2024-1950). Deserialization bugs keep recurring in WordPress plugins because unserialize is convenient. JSON decoding avoids the whole class. The record's KEV flag is false, and no source I retrieved reports exploitation of this CVE in the wild. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
What is a POP chain?
A sequence of existing class methods that a crafted object can trigger. The record says an attacker needs one from another plugin or theme to do serious harm.
Which version fixes it?
The changeset in the record compares 1.6.7 with 1.6.8, so 1.6.8. Confirm on the plugin page.
Sources
Last reviewed: 19 October 2026.
