Local File Inclusion Vulnerability in Visual Composer Website Builder for WordPress
CVE-2026-12227

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Visual Composer Website Builder
Vendor
CVE Published:
24 September 2026

What is CVE-2026-12227?

The Visual Composer Website Builder plugin for WordPress allows local file inclusion through the vcv-template parameter in all versions up to and including 45.16.0. This vulnerability enables unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to unauthorized access to sensitive information, execution of harmful PHP code, and bypassing of access controls. Attackers can exploit this flaw by uploading malicious scripts disguised as harmless files, putting WordPress sites at significant risk.

Affected Version(s)

Visual Composer Website Builder 0 <= 45.16.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3619572/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tin Pham (TF1T)
Trong Pham (dtro)
Hao Ngo
.