CVE-2025-14071 is a deserialization of untrusted data vulnerability (CWE-502) in the Live Composer – Free WordPress Website Builder plugin for WordPress, affecting all versions up to 2.0.2. The flaw exists in the dslc_module_posts_output shortcode, allowing authenticated users with Contributor-level permissions or higher to inject PHP objects. However, the plugin itself does not contain a POP (Property Oriented Programming) chain necessary to exploit this vulnerability independently. Exploitation requires the presence of an additional plugin or theme on the target system that contains a suitable POP chain. If such a chain exists, attackers may leverage it to perform critical actions including arbitrary file deletion, data disclosure, or remote code execution. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity.

An attacker with Contributor-level or higher access can inject PHP objects via deserialization, potentially leading to arbitrary file deletion, sensitive data exposure, or code execution if a suitable POP chain is present in other installed plugins or themes. Without such a POP chain, the vulnerability has no direct impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict Contributor-level access to trusted users only and review installed plugins and themes for known POP chains that could be exploited in conjunction with this vulnerability.