CVE-2026-16502

CVE-2026-16502 is a PHP object injection flaw (CWE-502) in the Live Composer – Free WordPress Website Builder plugin, caused by deserialization of untrusted input in all versions up to and including 2.1.18. An authenticated attacker with contributor-level access or higher can supply a crafted serialized payload that the plugin deserializes, injecting an arbitrary PHP object into the application. The vulnerable software itself contains no known POP chain, so the flaw has no impact on its own; if another installed plugin or theme provides a POP chain, the attacker may be able to delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. Any WordPress site running an affected version is potentially exposed, but practical exploitability requires contributor-or-higher accounts and a suitable POP chain elsewhere on the site. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates about a 0.5% probability of exploitation within 30 days.

What to do: Update Live Composer to a release newer than 2.1.18 as soon as a patched version is available, and confirm the installed version under WP-Admin > Plugins. Audit installed plugins and themes for known insecure deserialization/POP chains, since those determine whether this flaw is actually exploitable on a given site. Reduce risk by reviewing and limiting contributor-level and higher accounts, as exploitation requires at least that privilege.