Local File Inclusion Vulnerability in Visual Composer Website Builder for WordPress

CVE-2026-12227

What is CVE-2026-12227?

CVE-2026-12227 is a notable vulnerability found within the Visual Composer Website Builder plugin for WordPress, a widely utilized tool enabling users to create and manage web content without extensive coding knowledge. This vulnerability specifically involves Local File Inclusion (LFI) in all versions up to and including 45.16.0 and is triggered via the vcv-template parameter. By exploiting this weakness, unauthenticated attackers can manipulate the inclusion of arbitrary files on the server, which can lead to the execution of malicious PHP code. The ramifications of this vulnerability extend to potential access control bypasses, sensitive data exposure, and overall server compromise, making it a critical concern for organizations relying on this plugin for their website functionality.

Potential Impact of CVE-2026-12227

1. Unauthorized Code Execution: Attackers can leverage this vulnerability to execute arbitrary code on the server, potentially leading to complete system takeover or further exploitation of connected resources.

2. Data Breach Risks: The ability to include and run files can expose sensitive information stored on the server, increasing the likelihood of data breaches and unauthorized access to users' personal data.

3. Access Control Bypass: The exploitation of this vulnerability may allow attackers to circumvent security protocols, giving them extended privileges and the ability to manipulate site content or maliciously redirect users.

References