Executive brief
The Live Composer website builder plugin for WordPress allows authenticated users with contributor-level access to inject malicious PHP objects through deserialization of untrusted input. While the plugin itself contains no dangerous code chains to exploit this flaw, an attacker could leverage the vulnerability to delete files, steal data, or execute code if other vulnerable plugins or themes are installed on the same WordPress site.
Technical details
This vulnerability is a PHP Object Injection (deserialization flaw) affecting the Live Composer plugin. It occurs when the plugin deserializes untrusted user input without proper validation, allowing an authenticated attacker with contributor-level privileges or higher to instantiate arbitrary PHP objects. The impact depends entirely on the presence of a PHP Object Graph (POP) chain in other installed plugins or themes; without one, the vulnerability has no practical exploitation path. If a suitable POP chain exists elsewhere on the system, an attacker could chain the injection to perform arbitrary actions such as file deletion, data exfiltration, or remote code execution.
Affected products
- WordPress.org Live Composer – Free WordPress Website Builder up to and including 2.1.18
Timeline
- 2026-09-08: disclosed