PHP Object Injection Vulnerability in Live Composer WordPress Plugin

CVE-2026-16502

What is CVE-2026-16502?

The Live Composer plugin for WordPress is vulnerable to PHP Object Injection due to the unsafe deserialization of untrusted input in all versions up to and including 2.1.18. This vulnerability allows authenticated attackers, with contributor-level access or higher, to potentially inject malicious PHP objects. Without a present PHP Object Pollution (POP) chain in the vulnerable software, the immediate risks are limited. However, if a complementary plugin or theme containing a POP chain is installed, it could enable attackers to execute a range of malicious actions, including but not limited to deleting files, accessing sensitive data, or executing arbitrary code. Website owners using this plugin should take immediate measures to update to the latest version to mitigate risks associated with this vulnerability.

References