Read the docs
TI-2026-10518 Aliases CVE-2026-12227GHSA-3q44-ppmv-jh7f

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

Priority MEDIUM 54CWE-98Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-98.

Summary

The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02773 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Visual ComposerVisual Composer Website Builderup to 45.16.0—No fix listedCNA
  • Visual Composer Website Builder VendorVisual Composer Affected up to 45.16.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12227
  2. 2026-10-03 Alias added: GHSA-3q44-ppmv-jh7f

References

Other 2

  • TI-2026-69546 Missing authorization in Visual Composer Website Builder plugin CVSS 3.1MEDIUM 5.3
  • TI-2024-23522 Cross-site scripting in Visual Composer Website Builder CVSS 3.1MEDIUM 6.5
  • TI-2023-06285 Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
  • TI-2022-02325 Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title' CVSS 3.1MEDIUM 6.4
  • TI-2022-02244 Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Text Block' CVSS 3.1MEDIUM 6.4
  • TI-2026-63999 WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences