Visual Composer CVE-2026-106596

The input description does not name the specific vulnerable feature, endpoint, or parameter - it only states that an access control security level is incorrectly configured, so the exact precondition cannot be extracted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication, no user interaction, and only network reachability to a site running Visual Composer Website Builder at version 45.16.3 or earlier. The primary limiting factor is impact scope: the flaw only yields limited confidentiality exposure (C:L), not data modification or site takeover, which meaningfully caps real-world risk despite the unauthenticated network vector.

This is a moderate-severity Missing Authorization issue (CWE-862) in the Visual Composer Website Builder WordPress plugin, rated CVSS 5.3. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction - favorable conditions for an attacker. However, the impact is deliberately narrow: C:L/I:N/A:N means only limited confidentiality exposure (e.g., unauthorized read access to data or functionality that should be access-controlled), with no integrity or availability impact and no scope change. No EPSS score, KEV listing, SSVC decision, or public POC is present in the input, so there is no signal of active or imminent exploitation. The signals are internally consistent - easy to reach but low-impact - so this reads as a real but lower-priority hardening fix rather than an emergency. Prioritize patching on high-value or data-sensitive WordPress sites, but it does not carry the urgency of a code-execution or active-exploitation finding.

A remote, unauthenticated attacker sends a direct request to a plugin endpoint or AJAX action that lacks a proper capability/authorization check, obtaining data or triggering functionality intended to be restricted. Because no authentication or user interaction is required, the request can be issued directly against any exposed site, but the outcome is limited to low-level information disclosure. No public exploit code is identified at time of analysis.