CVE-2023-52206 is a high severity (7.7 CVSS) PHP object injection flaw in the Page Builder: Live Composer plugin for WordPress, in versions through 1.5.25. Patchstack says an Author account can reach it. Patchstack lists 1.5.29 as the patched version, so update to 1.5.29 or later.
What's affected
The NVD record covers Page Builder: Live Composer, all versions through 1.5.25. The weakness is CWE-502 (Deserialization of Untrusted Data).
The sources describe the needed privilege in two ways. The CVSS vector in the record marks privileges required as high, and Patchstack lists the Author role. On a site with several writers, Author accounts are common, so do not assume the stricter reading protects you. Patchstack gives it medium priority, and the vector marks attack complexity as high.
The fixed release named by Patchstack is 1.5.29.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get live-composer-page-builder --field=version
The slug live-composer-page-builder comes from the Patchstack advisory address, so confirm it matches the folder under wp-content/plugins on your site. A version of 1.5.25 or lower is in the affected range. The Plugins screen in the dashboard shows the same version number.
Then see who can publish content:
wp user list --role=author --fields=ID,user_login,user_registered
Any Author account that nobody can explain is a reason to dig further.
What to do now
- Back up the site and its database.
- Update Page Builder: Live Composer to 1.5.29 or later, or run
wp plugin update live-composer-page-builder. - Review Author, Editor and Administrator accounts and remove any you do not recognise.
- Check the file system for plugin or theme files that changed recently and that you did not change.
- Reset passwords for privileged accounts if there is any doubt.
Why it matters
PHP object injection is a form of unsafe deserialization. When an application rebuilds objects from data that someone else controls, the data can steer which classes are created and which code runs as they are built and torn down. The impact then depends on what other classes are loaded on the site, which is why plugin flaws like this can reach well beyond the plugin.
The vector scores confidentiality, integrity and availability impact as high and marks the scope as changed. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
PHP object injection appeared in several plugin advisories published the same week, including CVE-2023-52202, CVE-2023-52205 and CVE-2023-52207, which cover other plugins. If you maintain many sites, search your inventory for the whole class instead of one name.
For a wider view of your own code, the free in-browser dependency scan and the Gold directory show which packages carry known CVEs, and reachability analysis helps you decide which findings to fix first. WordPress plugins installed from the admin screen do not sit in a manifest, so start with the wp-cli inventory above for those.
Quick check
Is object injection the same as remote code execution?
Not by itself. It lets a user influence object creation, and whether that becomes code execution depends on other classes present on the site. Treat it as serious because that outcome is possible.
Can I wait if only trusted people have Author accounts?
You lower the risk, but a stolen password for any Author account is enough. The patched release is a short update, so apply it.
Sources
Last reviewed: 19 October 2026.
