WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Update
Priority LOW 31CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.
Summary
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).
Why it matters now
EPSS 0.00938 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WPBakery Page Builder (Visual Composer) Clipboard (bitorbit): 4.5.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bitorbit | WPBakery Page Builder (Visual Composer) Clipboard | 4.5.0 and later; 4.5.8 to before 4.5.8 | 4.5.8 | Patch available | CNA |
- WPBakery Page Builder (Visual Composer) Clipboard Vendorbitorbit Affected 4.5.0 and later; 4.5.8 to before 4.5.8 Fixed in 4.5.8 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wpbakery_page_builder_clipboard_project:wpbakery_page_builder_clipboard:*:*:*:*:*:wordpress:*:* | 4.5.0 to before 4.5.8 | Vulnerable | Wpbakery Page Builder Clipboard Project |
- cpe:2.3:a:wpbakery_page_builder_clipboard_project:wpbakery_page_builder_clipboard:*:*:*:*:*:wordpress:*:* Versions 4.5.0 to before 4.5.8 Vulnerable ·Wpbakery Page Builder Clipboard Project
Remediation
- Fix · CNA WPBakery Page Builder (Visual Composer) Clipboard (bitorbit) Fixed in 4.5.8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24244
- 2026-10-03 Alias added: GHSA-x46v-m262-7xx6
References
More Wpbakery Page Builder Clipboard Project Wpbakery Page Builder Clipboard vulnerabilities
- TI-2024-04889 Cross-site scripting in WPBakery Page Builder CVSS 3.1MEDIUM 6.4
- TI-2021-06535 WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS) CVSS 3.1MEDIUM 5.4
Sources
- CVE-2021-24244 · CVE Program
- CVE-2021-24244 · NVD
- FIRST EPSS
- GHSA-x46v-m262-7xx6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences