PHP Object Injection in Live Composer WordPress Plugin

The Live Composer - Free WordPress Website Builder plugin for WordPress, in versions up to and including 2.1.18, is susceptible to a PHP Object Injection vulnerability. This flaw stems from the insecure deserialization of untrusted input handled by the plugin. While the Live Composer codebase itself does not contain a Property-Oriented Programming (POP) chain, the vulnerability can be leveraged if other plugins or themes installed on the same WordPress instance provide a usable POP chain. An attacker with contributor-level privileges or higher can trigger the deserialization process. Depending on the available POP chain, successful exploitation may result in unauthorized file deletion, information disclosure, or remote code execution. This vulnerability requires an initial foothold in the form of authenticated access, making it a risk primarily in multi-user WordPress environments where low-privileged users have access to the dashboard.

Impact

The vulnerability carries a CVSS v3.1 base score of 8.8, reflecting its potential for severe impact, including remote code execution. Targets include any WordPress site running the vulnerable Live Composer plugin version 2.1.18 or earlier. The actual impact is environment-dependent, relying on the presence of secondary software that provides the necessary gadgets for a POP chain, which may be commonly found in feature-rich WordPress ecosystems.

Recommendation

1. Update the Live Composer - Free WordPress Website Builder plugin to the latest available version beyond 2.1.18.
2. Perform an audit of installed WordPress plugins and themes to identify and remove unused components that may contain known gadget chains (POP chains).
3. Restrict administrative and contributor access to the WordPress dashboard to trusted users to prevent the exploitation of this and similar authenticated vulnerabilities.
4. Implement a Web Application Firewall (WAF) to monitor for malicious serialized PHP objects being passed via HTTP request parameters.