This vulnerability allows authenticated users with Contributor access to inject arbitrary PHP objects through the dslc_module_posts_output shortcode. While the plugin itself does not execute untrusted code, the injected objects can be exploited if the site also runs a plugin or theme that contains a vulnerable serialization or deserialization routine, enabling attackers to delete files, read sensitive data, or execute code. No stand‑alone payload is supplied by the plugin, so the impact depends on the presence of a separate vulnerable component.

Live Composer – Free WordPress Website Builder plugin for WordPress versions up to and including 2.0.2. Any WordPress site that has this plugin installed and enables the dslc_module_posts_output shortcode is at risk.

The CVSS score of 7.5 reflects a high risk to confidentiality, integrity, and availability. The EPSS score of <1% indicates a low likelihood of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires local authentication as a user with Contributor privileges; thereafter the attacker can supply crafted input to trigger object deserialization. If a second component containing a POP chain is present, the vulnerability can lead to remote code execution or other destructive actions. Until the plugin is updated or the supporting component is removed, the threat persists.