A PHP Object Injection flaw exists in the Live Composer – Free WordPress Website Builder plugin for all releases up to and including 2.1.18. The vulnerability is triggered when the plugin deserializes untrusted input provided via a shortcode. Because the flaw requires the presence of a vulnerable Plain Old PHP Object (POPO) in the running application, it does not provide immediate impact on its own. If an additional plugin or theme installed on the site contains such an object that can be abused, an attacker with contributor-level or higher rights can inject crafted payloads that may read sensitive data, delete files, or execute arbitrary code.

All installations of the Live Composer Free WordPress Website Builder plugin running versions 2.1.18 or older are affected. The plugin is a WordPress extension that adds a shortcode functionality to build pages and content within the WordPress administrative interface.

The base CVSS score of 8.8 reflects the high severity of the vulnerability when a POPO chain exists. The EPSS score is currently not available, and the vulnerability has not been listed in the CISA KEV catalog. The attack vector is inferred to be an authenticated attacker with a contributor role or higher who can submit data through the shortcode; the exploitation path depends on a second vulnerability that provides an exploitable object. Absent such a chain, the flaw has negligible impact; however, once a vulnerable POPO is present, standard PHP Object Injection techniques can result in remote code execution or other destructive actions.