CVE-2026-16502 Overview
The Live Composer – Free WordPress Website Builder plugin contains a PHP Object Injection vulnerability in all versions up to and including 2.1.18. The flaw stems from deserialization of untrusted input [CWE-502]. Authenticated attackers with contributor-level access or higher can inject arbitrary PHP objects into the application. The vulnerable plugin does not ship with a Property-Oriented Programming (POP) chain, so exploitation requires a POP chain provided by another installed plugin or theme. When such a chain exists, attackers may delete arbitrary files, retrieve sensitive data, or execute code.
Critical Impact
Authenticated contributor-level accounts can inject PHP objects that, when paired with a POP chain from another component, enable arbitrary file deletion, sensitive data retrieval, or remote code execution.
Affected Products
- Live Composer – Free WordPress Website Builder plugin versions ≤ 2.1.18
- WordPress sites running the vulnerable live-composer-page-builder plugin
- WordPress installations where contributor-or-higher accounts can be provisioned
Discovery Timeline
- 2026-09-08 - CVE-2026-16502 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-16502
Vulnerability Analysis
The vulnerability resides in the Live Composer plugin's downloads module (modules/downloads/module.php) where the plugin calls PHP's unserialize() on attacker-controllable input. PHP object injection [CWE-502] arises whenever untrusted data is passed to a deserialization routine without validation. During deserialization, PHP instantiates objects and invokes magic methods such as __wakeup(), __destruct(), or __toString(). Attackers craft serialized payloads that abuse these methods to trigger unintended behavior in classes already loaded by WordPress core, plugins, or themes.
The Live Composer codebase itself does not include a usable POP chain. Impact therefore depends on the presence of a gadget chain in another installed component. WordPress sites commonly load dozens of plugins and themes, which materially raises the probability that a suitable chain is available on any given deployment.
Root Cause
The plugin deserializes user-supplied input in the downloads module at the code paths referenced in the vendor changeset (module.php lines 4972, 4975, and 5685 in tags 2.1.10 and 2.1.16). No input validation, type enforcement, or allow-listing is performed prior to the unserialize() call, and no safe alternative such as json_decode() is used.
Attack Vector
An attacker first obtains a WordPress account with contributor privileges or higher. The attacker then submits a crafted serialized PHP payload through the affected downloads module endpoints. When the plugin deserializes the payload, PHP instantiates the specified objects and their magic methods execute automatically. If a POP chain exists in another loaded plugin or theme, the chain executes attacker-selected operations against the host filesystem, database, or PHP runtime. See the Wordfence Vulnerability Analysis and the WordPress Changeset #3628023 for the affected code paths and fix.
Detection Methods for CVE-2026-16502
Indicators of Compromise
- POST requests to Live Composer downloads module endpoints containing serialized PHP object markers such as O: or a: followed by class names and property counts.
- New or modified PHP files in wp-content/uploads/, wp-content/plugins/, or theme directories that were not deployed by administrators.
- Unexpected outbound HTTP connections originating from the PHP worker process shortly after contributor account activity.
- WordPress user accounts newly elevated to administrator or new administrator accounts created following contributor logins.
Detection Strategies
- Inspect web server access logs for requests targeting modules/downloads/module.php handlers that contain serialized payload signatures.
- Enable a WordPress security plugin or web application firewall (WAF) rule set that flags PHP serialization patterns in request bodies and query strings.
- Correlate contributor-role authentication events with subsequent file writes, cron modifications, or option table updates in wp_options.
Monitoring Recommendations
- Baseline plugin and theme file hashes and alert on any change outside of scheduled maintenance windows.
- Forward WordPress audit logs, PHP-FPM logs, and web server logs to a centralized analytics platform for correlation and retention.
- Monitor creation of scheduled tasks (wp_cron entries) and modifications to authentication-related options for indicators of post-exploitation persistence.
How to Mitigate CVE-2026-16502
Immediate Actions Required
- Update Live Composer – Free WordPress Website Builder to a version later than 2.1.18 that includes the fix delivered in WordPress Changeset #3628023.
- Audit all contributor, author, editor, and administrator accounts and revoke unused or unfamiliar accounts.
- Inventory installed plugins and themes and remove abandoned or unmaintained components that could supply a POP chain.
- Rotate WordPress secret keys in wp-config.php and reset passwords for privileged accounts if compromise is suspected.
Patch Information
The vendor addressed the vulnerability in the commit tracked as WordPress Changeset #3628023. Site owners should upgrade the live-composer-page-builder plugin to the patched release available through the WordPress plugin repository. Refer to the Wordfence Vulnerability Analysis for confirmation of fixed versions.
Workarounds
- Deactivate and remove the Live Composer plugin until the patched version can be deployed.
- Restrict contributor and author account provisioning and enforce multi-factor authentication for all authenticated roles.
- Deploy a WAF rule that blocks HTTP request bodies containing PHP serialized object patterns targeting the plugin's endpoints.
# Configuration example: WP-CLI commands to update the plugin and audit user roles
wp plugin update live-composer-page-builder
wp plugin list --status=active --format=table
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
