PHP Object Injection in Live Composer WordPress Plugin

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Wordfence

Description

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-16502

Affected Vendors & Products

Vendor	Product	Version / Range
live_composer	free_wordpress_website_builder	to 2.1.18 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a PHP Object Injection issue in the Live Composer WordPress plugin. It allows authenticated attackers with contributor-level access or higher to inject a PHP object via deserialization of untrusted input. The impact depends on other installed plugins or themes that might contain a POP chain, which could lead to actions like arbitrary file deletion, sensitive data retrieval, or code execution.

Impact Analysis

If exploited, this vulnerability could allow attackers to delete files, access sensitive data, or execute malicious code on your WordPress site. The risk is higher if other plugins or themes with a POP chain are installed, as they could be leveraged to escalate the attack.

Hi! I’m here to help you understand CVE-2026-16502. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70