CVE-2024-35780 HIGH

CVE-2024-35780: WordPress Page Builder: Live Composer plugin <= 1.5.42 - Contributor+ PHP Object Injection vulnerability

Vendor Live Composer Team
Product Page Builder: Live Composer
Weakness CWE-502 · Unsafe deserialization
Published June 19, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.42.

Explanation of Vulnerability in Simple Terms

02Summary

Live Composer Page Builder versions up to 1.5.42 contain a deserialization vulnerability that allows authenticated attackers to execute arbitrary PHP code on the site. The vulnerability requires low-level user privileges and high attack complexity, but successful exploitation grants full control over the site's functionality and data. Site administrators should update immediately to a patched version.

What an attacker can do

03Attacker Capabilities

Run their own PHP code on the site with the privileges of the web server.

Potential impact on your site

04Site Impact

Compromised site can have data stolen, modified, or deleted; malware injected; or be used to attack visitors.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account (e.g., contributor or subscriber role) on the site.

Key dates

06Disclosure timeline

June 19, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-49085 WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability CVE-2026-49109 WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability CVE-2026-39551 WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability CVE-2026-12115 Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import CVE-2026-49769 WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability