CVE-2026-16502: Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Live Composer (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.1.18 - Configuration
Ensure no additional plugin or theme containing a POP chain is installed on the site, since the described PHP Object Injection only has impact when a POP chain is present elsewhere.
WordPress plugin/theme containing a POP chain = Remove/avoid installation (do not install additional plugins or themes that include a POP chain)
Event History
Frequently Asked Questions
Which sites are realistically at risk of serious impact?
Sites running Live Composer version 2.1.18 or earlier are affected, but meaningful impact depends on a separate installed plugin or theme providing a usable PHP object-oriented programming (POP) chain. The vulnerable plugin itself has no known POP chain.
What access does an attacker need?
An attacker must be authenticated with at least Contributor-level WordPress access. No user interaction is required, and the attack can be performed remotely.
What could an attacker do if a POP chain is available elsewhere on the site?
The available impact depends on the additional plugin or theme's POP chain. Possible outcomes include deleting arbitrary files, retrieving sensitive data, or executing code.