WordPress Page Builder: Live Composer Plugin <= 1.5.25 is vulnerable to PHP Object Injection
CVE-2023-52206

7.7HIGH

Key Information:

Vendor

WordPress
Status
Page Builder: Live Composer
Vendor
CVE Published:
8 January 2024

What is CVE-2023-52206?

A vulnerability exists within the Live Composer Page Builder that allows for the deserialization of untrusted data. This flaw can lead to potential PHP object injection, posing a risk to the security of the application and the data it processes. Affected implementations of the Live Composer Page Builder, particularly versions prior to 1.5.25, could experience unauthorized data manipulation and exploitation due to this vulnerability.

Affected Version(s)

Page Builder: Live Composer <= 1.5.25

References

https://patchstack.com/database/vulnerability/live-compos...
vdb-entry

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

Credit

Le Ngoc Anh (Patchstack Alliance)
.