CVE-2025-14044
Published: 12 December 2025
Description
The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted input from the `lpblocks` cookie. This is due to the `lp_track()` function passing unsanitized cookie…
more
data directly to the `unserialize()` function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code granted they can access the WordPress site.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and sanitization of untrusted inputs such as the lpblocks cookie before deserialization to prevent PHP object injection.
Mandates identification, reporting, and timely correction of the specific flaw in the lp_track() function that passes unsanitized cookie data to unserialize().
Requires vulnerability scanning to identify the PHP object injection issue in the Visitor Logic Lite WordPress plugin.
Security SummaryAI
CVE-2025-14044 is a PHP Object Injection vulnerability in the Visitor Logic Lite plugin for WordPress, affecting all versions up to and including 1.0.3. The issue arises in the `lp_track()` function, which passes unsanitized data from the `lpblocks` cookie directly to PHP's `unserialize()` function, allowing deserialization of untrusted input. This enables injection of a PHP object and is classified as CWE-502, with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers who can access the WordPress site can exploit the vulnerability by supplying a malicious `lpblocks` cookie. Although no known Proof-of-POP (POP) chain exists within the vulnerable plugin, a POP chain provided by an additional plugin or theme on the target system could enable the attacker to delete arbitrary files, retrieve sensitive data, or execute arbitrary code.
Advisories and references, including Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/60fb6928-96fb-4c1f-989c-cc07965b5266?source=cve, detail the vulnerability. Source code references at https://plugins.trac.wordpress.org/browser/logic-pro/tags/1.0.3/logic-lite.php#L131 and https://plugins.trac.wordpress.org/browser/logic-pro/trunk/logic-lite.php#L131 point to the specific vulnerable line in the `lp_track()` function.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated PHP Object Injection via crafted cookie in public-facing WordPress plugin directly enables exploitation of public-facing application.