CVE Alert: CVE-2026-16502 – livecomposer – Live Composer

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

High risk where lower-privileged content authors exist, but immediate exploitation urgency cannot be confirmed because KEV, SSVC, EPSS and PoC status are not provided.

Successful exploitation is conditional rather than universal: impact depends on another installed component supplying a usable gadget chain. Where that condition exists, an attacker could progress from a legitimate low-level account to data theft, destructive file operations or code execution, potentially compromising the whole WordPress site.

### Most likely attack path

An internet-reachable WordPress instance (AV:N) can be targeted with low attack complexity (AC:L), without victim interaction (UI:N), once the attacker has contributor-level or higher privileges (PR:L). The scope is unchanged, but code execution in the web application context could still expose site data, alter content, plant persistence or provide a foothold for attacks against connected services.

### Who is most exposed

Sites allowing public registration, guest-to-contributor workflows, outsourced publishing or numerous third-party themes and plugins are most exposed. Shared hosting and heavily extended WordPress installations increase the chance that a compatible gadget chain is present.

Review contributor-level accounts, recent registrations and unexpected privilege changes.

Alert on unusual shortcode content, serialised payloads or rapid post edits.

Hunt for web-server child processes, outbound connections and file writes from PHP.

Compare plugin/theme inventories and integrity hashes against approved baselines.

### Mitigation and prioritisation

Patch promptly to the vendor-fixed release; remove the component if it is not required.

Disable public registration and minimise contributor permissions pending remediation.

Audit plugins and themes for gadget-chain exposure; remove unnecessary extensions.

Apply WAF rules and application monitoring for suspicious shortcode or request patterns.

Confirm KEV, SSVC, EPSS and PoC status before final queueing; absent those signals, retain high priority based on exposure.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.