Code Execution Vulnerability in WPBakery Page Builder Plugin
CVE-2026-110516
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 10 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110516?
The All in One Addons For WPBakery Page Builder plugin for WordPress allows a security oversight where a shortcode attribute is not properly validated. This vulnerability could permit users with a contributor role or higher to construct file paths leading to the inclusion and execution of arbitrary local PHP files on the server, posing significant risks to website security and integrity.
Affected Version(s)
All in One Addons For WPBakery Page Builder (formerly Visual Composer) 0 <= 1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.