PT-2025-50846 · WordPress · Visitor Logic Lite

Ivan Cese · Published 2025-12-12 · Updated 2025-12-17 · CVE-2025-14044

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Visitor Logic Lite plugin for WordPress versions up to and including 1.0.3

Description The Visitor Logic Lite plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input from the lpblocks cookie. The lp track() function passes unsanitized cookie data directly to the unserialize() function, allowing potential attackers to inject a PHP Object. While no known POP chain exists within the vulnerable software itself, the presence of a POP chain via an additional plugin or theme could allow attackers to delete arbitrary files, retrieve sensitive data, or execute code, provided they have access to the WordPress site.

Recommendations Update the Visitor Logic Lite plugin to a version beyond 1.0.3.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-14044

Affected Products

Visitor Logic Lite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14044 · Security Note
• https://twitter.com/cracbot/status/2001246043581899151 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/60fb6928-96fb-4c1f-989c-cc07965b5266?source=cve · Note
• https://plugins.trac.wordpress.org/browser/logic-pro/trunk/logic-lite.php#L131 · Note
• https://plugins.trac.wordpress.org/browser/logic-pro/tags/1.0.3/logic-lite.php#L131 · Note