Deserialization of Untrusted Data Vulnerability Affects Live Composer Page Builder
CVE-2024-35780

8.5HIGH

Key Information:

Vendor

WordPress
Status
Page Builder: Live Composer
Vendor
CVE Published:
19 June 2024

What is CVE-2024-35780?

The vulnerability in Live Composer Team Page Builder involves the deserialization of untrusted data. This flaw allows attackers to potentially manipulate data being processed by the Page Builder plugin, leading to PHP object injection attacks. Versions from n/a up to 1.5.42 are at risk, highlighting the importance of applying security updates and monitoring for exploits associated with this vulnerability. Users are advised to review the affected versions and take necessary precautions to safeguard their installations.

Affected Version(s)

Page Builder: Live Composer <= 1.5.42

References

https://patchstack.com/database/vulnerability/live-compos...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
.