Executive Summary
CVE-2026-12227 is a critical unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0. The flaw lives in PageTemplatesController, which handles WordPress's template_include filter to decide which template file renders a page. On vulnerable versions, that controller honors an attacker-supplied vcv-template query parameter (paired with vcv-template-type) when resolving which file to load — with no meaningful validation that the requested path actually belongs to the site's intended template set.
Because the parameter is read directly from an unauthenticated HTTP request, any visitor can point vcv-template at an arbitrary file on disk. If that file is interpretable as PHP, the server executes it. Researchers have also noted the flaw can be chained with "safe" file uploads (images or other permitted media types that smuggle PHP payloads) to reach full remote code execution, even where direct PHP file access would otherwise be blocked.
The vulnerability was disclosed via Wordfence Intelligence, carries a CVSS 3.1 score of 9.8 (Critical), and was published September 24, 2026. It is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program — "PHP Remote File Inclusion"). Visual Composer Website Builder shows 30,000+ active installations on WordPress.org as of this writing, and its current release, 45.16.3, was published the same day the advisory went public. Public proof-of-concept exploit code is already circulating on GitHub; the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no confirmed in-the-wild exploitation has been reported at publication time.
Vulnerability Overview
| Field | Value |
|---|---|
| CVE ID | CVE-2026-12227 |
| CVSS 3.1 Score | 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-98 — Improper Control of Filename for Include/Require Statement in PHP Program ("PHP Remote File Inclusion") |
| Component | PageTemplatesController, via the WordPress template_include filter |
| Vulnerable Parameter | vcv-template (combined with vcv-template-type) |
| Attack Vector | Network — unauthenticated HTTP request to any front-end page rendered by Visual Composer |
| Privileges Required | None |
| User Interaction | None |
| Assigner | Wordfence |
| Published | September 24, 2026 |
Affected Versions
| Component | Affected Version | Fixed Version |
|---|---|---|
| Visual Composer Website Builder (WordPress plugin) | ≤ 45.16.0 | 45.16.3 |
Visual Composer Website Builder's current release on WordPress.org is 45.16.3, published the same day this CVE went public. Some independent researchers examining the fix have flagged a nuance worth noting: part of what closes this specific exploitation chain traces back to WordPress core's own locate_template() path-traversal hardening (shipped in WordPress 7.1.2), rather than a fully self-contained re-validation inside the plugin's viewPageTemplate() logic. Sites should still update Visual Composer to 45.16.3 or later as the primary remediation, but administrators running any WordPress installation held back from core 7.1.2 should not assume the plugin update alone closes every variant of this issue.
Attack Vector
1. Attacker identifies a public WordPress site with Visual Composer
Website Builder (version 45.16.0 or earlier) active, and locates
any front-end page rendered through the plugin's template system.
2. Attacker sends an unauthenticated GET request to that page,
appending crafted query parameters, e.g.:
https://victim-site.example/some-page/?vcv-template-type=vc&vcv-template=../../../../wp-config
3. PageTemplatesController hooks WordPress's template_include filter
and reads the vcv-template / vcv-template-type values directly
from the request without adequately validating that the resolved
path stays within the plugin's intended template directory.
4. The resolved path is passed to a PHP include/require statement.
Because the filename is attacker-controlled, this allows:
- Disclosure of arbitrary readable files on the server
(configuration files, other plugins' source, etc.)
- Execution of arbitrary PHP if the included file contains
PHP code — including files an attacker separately planted
through an unrelated "safe" upload path (e.g. an image
upload feature that does not strip embedded PHP).
5. No authentication, prior session, or user interaction is required.
The vulnerable code path is reached on ordinary, unauthenticated
page loads once the crafted parameters are present.
6. If PHP execution is achieved, the attacker gains code execution
in the context of the web server user, enabling further
compromise: webshell placement, credential theft from
wp-config.php, or lateral movement into the broader hosting
environment.Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | High — arbitrary readable files (including wp-config.php and its database credentials) can be disclosed to an unauthenticated attacker |
| Integrity | High — if a PHP-capable file can be included, the attacker executes arbitrary code with the privileges of the web server |
| Availability | High — a successful compromise can be used to deface, disable, or destroy the site, and the LFI primitive itself can be abused to crash request handling |
| Access Control | Complete bypass — the vulnerable code path requires no authentication and no user interaction |
| Chained Risk | Sites that allow "safe" uploads (images, media) elsewhere in their stack are at elevated risk of LFI-to-RCE chaining, since Visual Composer's flaw supplies the "include" half of that chain |
Immediate Remediation
Update the plugin
- Update Visual Composer Website Builder to version 45.16.3 or later immediately. This is the primary, vendor-supported fix.
- Confirm the update actually applied — check the plugin version shown in
wp-admin → Pluginsrather than trusting an auto-update notification alone.
Harden WordPress core alongside the plugin update
- Ensure the WordPress core installation itself is current, ideally at 7.1.2 or later, since researchers examining this CVE found the underlying path-resolution hardening is partly a core-level fix. Do not treat the plugin update as sufficient on installations running an older WordPress core.
If you cannot patch immediately
- Block or filter requests containing a
vcv-templatequery parameter at the WAF, reverse proxy, or CDN edge until the update is applied. - Temporarily deactivate Visual Composer Website Builder on any site where the plugin is not actively in use for page rendering.
- Restrict or audit any "safe" file upload functionality (media libraries, form plugins) on the same site, since those uploads are the other half of the LFI-to-RCE chain researchers have described.
Detection Indicators
| Indicator | Notes |
|---|---|
Requests containing vcv-template= with path-traversal sequences | Look for ../, encoded traversal (%2e%2e%2f), php://, or absolute filesystem paths in access logs |
Requests referencing sensitive filenames via vcv-template | E.g. attempts targeting wp-config, .htaccess, or other plugins' PHP files |
| Unexpected PHP files in uploads or media directories | A sign the LFI is being chained with a separate "safe" upload path to plant executable payloads |
| Anomalous outbound connections or new admin accounts | Post-exploitation indicators if the LFI was successfully escalated to PHP execution |
| Traffic matching public PoC signatures | Public proof-of-concept exploit code is already circulating; scanning traffic against this parameter should be treated as reconnaissance at minimum |
Post-Remediation Steps
- Confirm Visual Composer Website Builder is running 45.16.3 or later, and confirm WordPress core is current.
- Search web server and access logs retroactively for requests containing
vcv-templateto determine whether the site was probed or exploited before patching. - Audit uploads and media directories for unexpected PHP files or files with mismatched extensions/content.
- If any evidence of successful inclusion or code execution is found, rotate WordPress secret keys and salts, reset all administrator credentials, and review
wp-config.phpfor unauthorized changes. - Review other plugins on the same site that accept file uploads, since they represent the other half of the LFI-to-RCE chain described by researchers.
- Continue monitoring Wordfence and NVD for any follow-up advisories, given the noted overlap with WordPress core's own template-resolution hardening.
References
- NVD — CVE-2026-12227
- Wordfence Intelligence — CVE-2026-12227
- GitHub — murrez/CVE-2026-12227 Proof of Concept
- Visual Composer Website Builder — WordPress.org Plugin Page
- TheHackerWire — CVE-2026-12227 PoC, Exploit Status & Vulnerability Details
- Strix — CVE-2026-12227: Visual Composer Website Builder Vulnerability