PHP Object Injection Vulnerability in Live Composer Website Builder Plugin for WordPress

CVE-2025-14071

What is CVE-2025-14071?

The Live Composer plugin for WordPress is susceptible to a PHP Object Injection vulnerability due to the deserialization of untrusted input in the dslc_module_posts_output shortcode. This flaw affects all versions up to and including 2.0.2 and allows authenticated attackers with Contributor-level access or higher to exploit the vulnerability and inject a PHP Object. While no known PHP Object Injection chain exists within the plugin itself, if the vulnerable site has other plugins or themes containing such a chain, attackers could potentially execute malicious actions including deleting arbitrary files, accessing sensitive information, or executing arbitrary code. Proper security measures should be taken to mitigate these risks.

References