CVE-2026-65568
MediumCVSS 5.0Summary
The Visual Composer Website Builder plugin version 45.15.0 and earlier has a broken access control vulnerability for users with the Contributor role. A low-privileged user can gain unauthorized access to functions.
Risk Assessment
The risk includes the possibility of privilege escalation by a Contributor, potentially leading to content or site configuration modifications.
Recommendation
Update Visual Composer Website Builder to a version above 45.15.0 that includes the access control fix.
Other vulnerabilities in Visual Composer Website Builder
See all- CVE-2026-12227Critical
The Visual Composer Website Builder plugin for WordPress up to version 45.16.0 is vulnerable to Local File Inclusion via the `vcv-template` parameter. Unauthenticated attackers can include and execute arbitrary files on the server, allowing execution of any PHP code in those files.
- CVE-2026-62138Medium
The Visual Composer Website Builder plugin in versions up to and including 45.16.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of malicious script into site content.
Original NVD description (English source)
Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.