Extensive VC Addons CVE-2025-14475

The Extensive VC Addons for WPBakery plugin (version 1.9.1 or earlier) must be installed and active on the WordPress site, exposing the extensive_vc_init_shortcode_pagination AJAX action to unauthenticated callers via admin-ajax.php. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N), but full code execution is limited by AC:H: the attacker must supply a shortcode_name value that both defeats the plugin's insufficient path normalization/validation and resolves to an includable PHP file already present or plantable on the server (e.g. an uploaded media file, temp/session file, or poisoned log), since LFI executes existing files rather than injecting new code directly.

This is a genuinely high-priority flaw despite one mitigating metric. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1) shows unauthenticated, network-reachable exploitation with full CIA impact, consistent with the CWE-98 file-inclusion-to-RCE classification and the description's claim of 'execution of any PHP code.' The single tempering factor is AC:H, which reflects that turning a Local File Inclusion into reliable code execution requires an includable PHP file to already exist on disk (e.g. an uploaded file, session/log file poisoning, or a bundled PHP path), plus successful bypass of the plugin's partial path normalization - this is not a single-shot, guaranteed win. No EPSS score, KEV listing, or public POC was supplied in the intelligence set, so there is no evidence of active exploitation or automated weaponization at this time; the risk rating rests on the exploitability profile of unauth LFI-to-RCE in WordPress rather than observed attacks. Signals are consistent here (no conflicts between CVSS, CWE, and description), but the AC:H caveat means real-world exploitation is more skilled/targeted than mass-automated until a public exploit emerges.

An unauthenticated attacker sends a crafted request to the WordPress admin-ajax.php endpoint invoking the extensive_vc_init_shortcode_pagination AJAX action with a malicious shortcode_name value using path traversal sequences to point at an attacker-influenced PHP file (such as a previously uploaded file or a poisoned log). The vulnerable extensive_vc_get_module_template_part function includes and executes that file, running arbitrary PHP as the web server user. No public exploit code was identified in the provided data, and AC:H means the attacker must arrange an includable PHP payload and defeat partial path validation.