What is the CVSS score of CVE-2025-14044?

CVE-2025-14044 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Visitor Logic Lite are affected by CVE-2025-14044?

Visitor Logic Lite versions 1.0.3 and earlier contain a PHP object injection flaw that lets an attacker deliver a crafted serialized payload through the lpblocks cookie and have it processed by the…

How to fix or mitigate CVE-2025-14044?

Within 24 hours, inventory every deployment of the Visitor Logic Lite plugin and confirm which instances are running version 1.0.3 or earlier, then disable or remove the plugin on any site where it is not business-critical; for sites that must keep it, apply edge filtering to reject or strip the lpblocks cookie on inbound requests and review existing WAF rules for coverage of serialized PHP payload patterns. Within 7 days, complete a component inventory of all other plugins and themes on the affected sites to identify any that could provide a usable PHP object injection gadget chain, prioritizing removal of abandoned, unmaintained, or untrusted components, and enable logging and alerting on requests carrying the lpblocks cookie so that probing activity is detected. Within 30 days, track the vendor advisory for a fixed version of Visitor Logic Lite and schedule emergency change windows to deploy it as soon as it is released, re-test the lpblocks cookie filtering after any plugin or theme change to ensure coverage is retained, and if the vendor remains silent, formally evaluate decommissioning the plugin in favor of an alternative visitor-tracking capability. Vendor patch status: No vendor-released patch identified at time of analysis. Exploitation status: no public exploit identified at time of analysis.

Visitor Logic Lite CVE-2025-14044

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-12-12 security@wordfence.com

PHP WordPress Information Disclosure Deserialization Wordpress Plugin

8.1

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remotely supplied cookie (AV:N) deserialized without auth (PR:N/UI:N), but reaching impact depends on an external POP chain (AC:H); potential file deletion, data theft, and RCE justify C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 20:46 vuln.today

CVE Published

Dec 12, 2025 - 04:15 cve.org

HIGH 8.1

DescriptionCVE.org

The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted input from the lpblocks cookie. This is due to the lp_track() function passing unsanitized cookie data directly to the unserialize() function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code granted they can access the WordPress site.

AnalysisAI

PHP Object Injection in Visitor Logic Lite (versions ≤1.0.3) lets unauthenticated attackers supply a malicious serialized payload via the lpblocks cookie, which the lp_track() function passes directly to unserialize(). Successful exploitation for file deletion, data retrieval, or code execution requires an additional installed plugin or theme that provides a usable POP gadget chain, since the plugin itself contains none. No public exploit code has been identified at time of analysis, and EPSS is low at 0.54% (44th percentile), consistent with the conditional nature of the flaw.

Technical ContextAI

The flaw stems from CWE-502 (Deserialization of Untrusted Data): the lp_track() function in logic-lite.php (line 131) reads the lpblocks cookie and calls unserialize() on its contents without sanitization or validation. PHP's unserialize() can instantiate arbitrary objects and trigger magic methods such as __wakeup() or __destruct(), enabling PHP Object Injection. However, the vulnerable plugin contains no POP (Property-Oriented Programming) gadget chain, so object injection alone yields no direct impact. Exploitation becomes viable only when the target site also runs another plugin or theme that supplies a usable gadget chain, which is why the assessed CVSS vector rates Attack Complexity as High (AC:H). The affected technology stack is WordPress with the Visitor Logic Lite plugin; the code references point to the plugin's Trac repository (tags/1.0.3 and trunk).

Affected ProductsAI

Visitor Logic Lite plugin for WordPress, all versions up to and including 1.0.3. The vulnerable file is logic-lite.php (line 131) in the plugin slug 'logic-pro' as seen in the WordPress plugin repository references. No CPE strings were provided in the input data. For details, see the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/60fb6928-96fb-4c1f-989c-cc07965b5266?source=cve and the plugin source at https://plugins.trac.wordpress.org/browser/logic-pro/tags/1.0.3/logic-lite.php#L131.

RemediationAI

No vendor-released patch identified at time of analysis. Until a fixed version is available, the most effective mitigation is to disable or remove the Visitor Logic Lite plugin, especially if the site hosts other plugins or themes that may contain a POP gadget chain. If the plugin must remain active, consider blocking or stripping the lpblocks cookie at the WAF or reverse proxy level, though this may interfere with the plugin's visitor tracking functionality. Alternatively, patch lp_track() to avoid unserialize() by using JSON decoding or a safe allowlist for cookie data; this requires custom code changes and thorough testing. Monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/60fb6928-96fb-4c1f-989c-cc07965b5266?source=cve) and the plugin's Trac pages for updates. Note that exploitation is site-specific and depends on an external gadget chain, so risk is elevated only in environments with additional vulnerable components.