Local File Inclusion in Visual Composer Website Builder Plugin

The Visual Composer Website Builder plugin for WordPress contains a critical Local File Inclusion (LFI) vulnerability identified as CVE-2026-12227. The flaw exists within the handling of the vcv-template parameter, which fails to properly sanitize user-supplied input before using it to include files on the server filesystem. An unauthenticated attacker can exploit this vulnerability to force the application to include and execute arbitrary local files, including those containing malicious PHP code. This capability allows attackers to bypass application-level access controls, exfiltrate sensitive configuration files such as wp-config.php, or achieve full Remote Code Execution (RCE) if the server permits the inclusion of attacker-controlled files like uploaded images containing embedded PHP payloads. This vulnerability affects all versions of the plugin up to and including 45.16.0.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code with the privileges of the web server process. This can lead to total site compromise, data theft, and the establishment of persistent backdoors on the affected WordPress installation. The vulnerability is highly severe (CVSS 9.8) and impacts any WordPress site utilizing the Visual Composer Website Builder plugin within the affected version range.

Recommendation

• Update the Visual Composer Website Builder plugin to the latest available version (beyond 45.16.0) immediately.
• Implement Web Application Firewall (WAF) rules to inspect incoming HTTP requests for suspicious patterns in the vcv-template parameter, specifically looking for directory traversal sequences (e.g., ../) or unauthorized file extensions.
• Audit web server access logs for requests containing the vcv-template parameter aimed at sensitive system files like /etc/passwd or application configuration files.