Vendor
Visual Composer Website Builder for WordPress versions 45.16.0 and earlier are vulnerable to unauthenticated local file inclusion via the vcv-template parameter, allowing arbitrary file execution.