PHP Object Injection in Visitor Logic Lite Plugin for WordPress

CVE-2025-14044

What is CVE-2025-14044?

The Visitor Logic Lite plugin for WordPress suffers from a PHP Object Injection vulnerability due to the deserialization of untrusted data from the 'lpblocks' cookie. This occurs because the 'lp_track()' function directly passes unsanitized cookie information to the 'unserialize()' function. Attackers without authentication can exploit this flaw to inject PHP objects. Although no known payloads are available within the affected plugin, if an attacker gains access to the WordPress site, the vulnerability can be exploited in conjunction with other plugins or themes that may introduce a potentially dangerous payload chain, allowing for arbitrary file deletion, sensitive data retrieval, or code execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References