EUVD-2026-72695
GHSA-mmpp-99gg-2rq8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain contributor-level WordPress account
-
DeliverySubmit serialized PHP object via downloads module
-
ExploitPHP deserializes attacker-controlled payload
-
ExecutionTrigger POP chain gadget in co-installed plugin/theme
-
ImpactExecute arbitrary code or delete files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concurrent conditions: (1) contributor-level WordPress authentication or higher - anonymous or subscriber-level access is insufficient per the CVSS PR:L vector; (2) a Property-Oriented Programming (POP) chain must be present via a separately-installed plugin or theme on the same WordPress instance, as the vulnerable plugin itself contains no known gadget chain; and (3) Live Composer - Free WordPress Website Builder version 2.1.18 or earlier must be installed and active. The dual prerequisite of authenticated access and a co-installed POP chain limits realistic exploitation to open-registration or multi-tenant WordPress environments with broad plugin estates. Sites with minimal plugin installations and no open contributor registration face materially lower risk than the CVSS score alone suggests. |
| Impact | The provided CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a worst-case scenario that assumes a POP chain is already available on the target site, but the Wordfence advisory explicitly states no POP chain exists within the vulnerable plugin itself - meaning impact is zero on WordPress instances where no co-installed component supplies gadget classes. This conditional-impact characteristic is common across WordPress deserialization CVEs and substantially deflates real-world risk compared to the raw score; even a mid-sized municipal IT team in leszno running a modest WordPress deployment with only a handful of plugins may face no immediate exploitable impact if those plugins carry no known gadgets. EPSS data is absent from this advisory. No CISA KEV listing and no public POC reduce immediacy, but contributor-level access - often obtainable via open WordPress registration - is a low barrier, making prompt patching the prudent posture over deferral, particularly for sites with large plugin estates. |
| Exploit ScenarioDerived | An attacker registers or obtains a contributor-level WordPress account on a target site running Live Composer ≤ 2.1.18, then submits a crafted serialized PHP payload through the plugin's downloads module functionality. If a co-installed plugin or theme provides a usable POP chain gadget - such as a __destruct method that writes attacker-controlled content to the filesystem - PHP's deserialization triggers the chain, enabling arbitrary file creation, deletion, or remote code execution. No public proof-of-concept code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
PHP Object Injection in the Live Composer - Free WordPress Website Builder plugin (all versions ≤ 2.1.18) enables authenticated attackers with contributor-level access to inject arbitrary PHP objects via deserialization in the plugin's downloads module. Real-world impact is entirely conditional on whether a Property-Oriented Programming (POP) chain is present in a co-installed plugin or theme; without one, exploitation produces no tangible effect. When a POP chain is available, consequences can include arbitrary file deletion, sensitive data extraction, or remote code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
RemediationAI
Update the Live Composer - Free WordPress Website Builder plugin via the WordPress admin dashboard or WP-CLI to the version released in SVN changeset 3628023 (https://plugins.trac.wordpress.org/changeset/3628023/), which represents the upstream fix; a specific patched release version number is not independently confirmed in the available data, so administrators should install the latest available version above 2.1.18 and verify it post-dates this changeset. As a compensating control, restrict WordPress user registration and limit the contributor role to fully trusted accounts, since contributor-level authentication is a hard prerequisite for exploitation. Additionally, audit co-installed plugins and themes for known POP chain gadgets - if none are present, the deserialization flaw is currently inert. Sites running the Wordfence security plugin should ensure firewall rules are up to date, as Wordfence often deploys virtual patches for vulnerabilities it discovers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the plugin's downloads module (modules/downloads/module.php), confirmed across at least versions 2.1.10 and 2.1.16 via WordPress SVN source references at lines L4972, L4975, and L5685. PHP's unserialize() function is invoked on attacker-supplied input without sanitization, constituting a textbook CWE-502 (Deserialization of Untrusted Data) vulnerability. During deserialization, PHP instantiates arbitrary class objects and triggers magic methods (__wakeup, __destruct, __toString), which can be chained into a POP sequence that performs filesystem or code-execution operations. The affected product is identified by CPE cpe:2.3:a:livecomposer:live_composer_-_free_wordpress_website_builder:*:*:*:*:*:*:*:* covering all releases through 2.1.18. POP chain exploitation is a well-documented WordPress attack pattern, and many popular plugins and themes carry gadget classes that enable file writes or command execution when chained.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H because real impact requires a POP chain in a separately-installed component, a condition entirely outside the attacker's control.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Live Composer - Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Articles & Coverage 2
Executive ViewAI
Live Composer WordPress page builder plugin (versions through 2.1.18) exposes organizations to remote code execution risk through a PHP object injection flaw. Exploitation requires a contributor-level account but only succeeds if co-installed plugins contain specific exploitable code patterns-a condition that varies by WordPress configuration. Organizations must immediately audit their plugin portfolios to determine exposure.
Until a vendor patch is released: (1) Audit co-installed plugins and themes for PHP object injection gadget chains using automated security scanners; (2) Restrict contributor and editor level WordPress roles strictly to known trusted personnel; (3) Disable Live Composer on any site where gadget chains are discovered or where contributor access cannot be adequately restricted; (4) Subscribe to the plugin vendor's security update channel and monitor WPScan/WordPress security advisory feeds; (5) Implement server-level monitoring for PHP object injection attack patterns in access and error logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB