Vulnerability in Visual Composer Website Builder — CVE-2026-12227

What to do now

Update Visual Composer Website Builder to 45.16.1 or later.

Affected versions

• Everything up to and including 45.16.0

The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

This description is reproduced verbatim from the public vulnerability record.

• https://www.wordfence.com/threat-intel/vulnerabilities/id/486c1c7c-5a66-42d3-85b0-13ce52a16ed1?source=api-prod

Part of this record comes from Wordfence Intelligence. Original: https://www.wordfence.com/threat-intel/vulnerabilities/id/486c1c7c-5a66-42d3-85b0-13ce52a16ed1
Copyright 2012-2026 Defiant Inc. / Full license text

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.