Visual Composer
Visual Composer Website Builder 45.16.0 and earlier permits unauthenticated local file inclusion through the vcv-template parameter. Update to 45.16.1 or later immediately.
Visual Composer Website Builder 45.16.0 and earlier is vulnerable to unauthenticated local file inclusion through the vcv-template parameter. The issue is tracked as CVE-2026-12227 and carries a CVSS 9.8 Critical rating. Update to 45.16.1 or later; the current WordPress.org release is 45.16.2.
Impact and affected versions
- Plugin: Visual Composer Website Builder (
visualcomposer) - Affected versions: 45.16.0 and earlier
- Privilege required: None
- User interaction: None
- Attack class: Local file inclusion
- Fixed version: 45.16.1; install the latest available release
According to the Wordfence Intelligence disclosure, untrusted input in the vcv-template parameter can select a local file for inclusion. An unauthenticated attacker may use this to bypass access controls, expose sensitive data, or execute PHP code already present in an includable file. Even file types normally treated as safe can become dangerous when their contents are interpreted through a PHP include path.
This is Visual Composer Website Builder, not WPBakery Page Builder. Confirm the installed plugin slug before taking action.
Immediate remediation
- Back up the site and database.
- Update Visual Composer Website Builder to 45.16.1 or later. Prefer the current release from the official plugin directory.
- If an immediate update is impossible, deactivate the plugin until the fixed release can be installed. A generic WAF rule is defense in depth, not a permanent fix.
- After updating, test Visual Composer pages, templates, headers, footers, and WooCommerce layouts.
Verify the installed version without changing the site:
wp plugin get visualcomposer --fields=name,status,version,update --format=tableInvestigation guidance
Review web-server and WAF logs for unusual requests containing vcv-template, especially from unauthenticated clients. Check writable directories for unexpected PHP files and review recently modified plugins, themes, must-use plugins, administrator accounts, and scheduled tasks. Preserve suspicious files and logs before cleanup. A clean log search does not prove that exploitation did not occur.
If local file inclusion appears to have reached executable content, isolate the site, restore WordPress and plugin code from trusted sources, rotate credentials and secrets, and perform a full incident response review.
Sources
