Security Alert Summary
The Visual Composer Website Builder plugin for WordPress has a Local File Inclusion vulnerability via the vcv-template parameter in all versions up to and including 45.16.0. An unauthenticated attacker can include and execute files on the server, potentially running PHP code from included files and accessing sensitive data.
CVE Details
- CVE ID: CVE-2026-12227
- Affected component: Visual Composer Website Builder plugin for WordPress
- Affected versions: All versions up to and including 45.16.0
- Published: September 24, 2026 at 10:17:32 AM UTC
- Last modified: September 24, 2026 at 4:17:06 PM UTC
- CVSS v3.1: Base Score 9.8, Severity CRITICAL, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: No authentication required; Privileges Required: NONE; User Interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- CWE: CWE-98 (Local/Remote File Inclusion)
Technical Details
This vulnerability is a Local File Inclusion (LFI) condition reachable via the vcv-template parameter. In affected versions, the plugin allows inclusion of local files specified through that parameter without sufficient validation or filtering. As a result, an attacker who can control the parameter value may cause the application to include files from the server filesystem.
The CVE description states that included files can contain executable PHP code, and that inclusion of files treated as “safe” (for example images or other uploadable file types) can be used to bypass access controls and achieve code execution. The issue exists because input supplied via vcv-template can lead to file inclusion without the necessary checks to restrict paths, file types, or execution contexts.
Impact is limited to the behaviors described: inclusion and possible execution of arbitrary files, exposure of sensitive data present in those files, and bypassing of intended access controls. The vulnerability does not require authentication and can be triggered remotely over the network.
How This Could Impact Your Website
Imagine a small WordPress site with a site owner, an internal editor, and an external contractor who uploads media. If an attacker can craft requests that use the vulnerable vcv-template parameter, they could include files from the server. This might allow access to configuration files or other sensitive data, or execute PHP code if an uploaded file is included. Practical consequences include exposure of internal user email addresses and other data, and an increased risk of targeted phishing or social engineering against staff or contractors.
For example, an attacker could leverage an image or other uploadable file type that is accepted by the site, then include that file via the vulnerability to execute code or read protected files. This could lead to data disclosure or actions performed with the privileges of the web server process.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Until you can confirm an update is applied, restrict access to administration and upload interfaces where possible.
- Review and reduce unnecessary user roles and capabilities, especially for contributor or upload-capable accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from your site.
- Monitor site activity, file uploads, and web server logs for unusual behavior or unexpected file inclusions.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
