Is CVE-2026-16502 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16502 being exploited in the wild.

How severe is CVE-2026-16502?

High severity, with a CVSS score of 8.8, published 8 September 2026.

Which products and versions are affected?

WordPress.org Live Composer – Free WordPress Website Builder up to and including 2.1.18.

Is there a fix for CVE-2026-16502?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16502 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16502?

Check whether you run WordPress.org Live Composer – Free WordPress Website Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16502: Live Composer PHP Object Injection via deserialization

CVE-2026-16502 · Severity: high · CVSS 8.8 · Published 2026-09-08

The Live Composer website builder plugin for WordPress allows authenticated users with contributor-level access to inject malicious PHP objects through deserialization of untrusted input. While the plugin itself contains no dangerous code chains to exploit this flaw, an attacker could leverage the vulnerability to delete files, steal data, or execute code if other vulnerable plugins or themes are installed on the same WordPress site.

Vendors: WordPress.org.

Quick answers

Is CVE-2026-16502 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16502 being exploited in the wild.
How severe is CVE-2026-16502?: High severity, with a CVSS score of 8.8, published 8 September 2026.
Which products and versions are affected?: WordPress.org Live Composer – Free WordPress Website Builder up to and including 2.1.18.
Is there a fix for CVE-2026-16502?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16502 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16502?: Check whether you run WordPress.org Live Composer – Free WordPress Website Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a PHP Object Injection (deserialization flaw) affecting the Live Composer plugin. It occurs when the plugin deserializes untrusted user input without proper validation, allowing an authenticated attacker with contributor-level privileges or higher to instantiate arbitrary PHP objects. The impact depends entirely on the presence of a PHP Object Graph (POP) chain in other installed plugins or themes; without one, the vulnerability has no practical exploitation path. If a suitable POP chain exists elsewhere on the system, an attacker could chain the injection to perform arbitrary actions such as file deletion, data exfiltration, or remote code execution.

Affected products

WordPress.org Live Composer – Free WordPress Website Builder up to and including 2.1.18

Timeline

2026-09-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.