CVE-2026-12227
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
The Visual Composer Website Builder plugin for WordPress up to version 45.16.0 is vulnerable to Local File Inclusion via the `vcv-template` parameter. Unauthenticated attackers can include and execute arbitrary files on the server, allowing execution of any PHP code in those files.
Risk Assessment
Attackers can bypass access controls, obtain sensitive data, or achieve code execution if images and other 'safe' file types can be uploaded and included.
Recommendation
Update the Visual Composer Website Builder plugin to the latest patched version.
Other vulnerabilities in Visual Composer Website Builder
See all- CVE-2026-65568Medium
The Visual Composer Website Builder plugin version 45.15.0 and earlier has a broken access control vulnerability for users with the Contributor role. A low-privileged user can gain unauthorized access to functions.
- CVE-2026-62138Medium
The Visual Composer Website Builder plugin in versions up to and including 45.16.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of malicious script into site content.
Original NVD description (English source)
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.