Visual Composer Website Builder CVE-2026-12227

No authentication required - unauthenticated remote exploitation (PR:N/UI:N) against WordPress sites running Visual Composer Website Builder version 45.16.0 or earlier, triggered through the vcv-template request parameter. The primary limiting factor is impact scope: bypassing access controls and reading sensitive files works directly, but achieving full arbitrary PHP code execution additionally requires that the attacker can place an includable file on the server (e.g., uploading an image or other 'safe' file type that is then included), as stated in the description. No non-default configuration is otherwise required.

All available signals point to this being a genuine high-priority issue rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, unauthenticated exploitation with low complexity and no user interaction, and the CWE-98 (PHP file inclusion) classification aligns with the description of arbitrary file inclusion and PHP execution via the vcv-template parameter. Impact is legitimately high: even where full RCE is gated on being able to upload a 'safe' file, the flaw unconditionally allows access-control bypass and disclosure of sensitive files, which independently justifies C:H. No EPSS score, KEV listing, or public POC is present in the supplied data, so there is currently no evidence of active exploitation or automated weaponization - but the combination of unauthenticated pre-auth reach and a very widely deployed page-builder plugin makes this an attractive mass-scan target once exploit details circulate. Net: prioritize patching promptly; the absence of KEV/EPSS reflects data timing, not low real-world risk.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running Visual Composer, setting the vcv-template parameter to reference a file path on the server. The plugin includes and executes that file as PHP; if the attacker has first uploaded a benign-looking file (e.g., an image containing PHP) or can point at a sensitive/log file, this yields code execution or disclosure of configuration and credential data. No public exploit code is identified in the provided data, but the low-complexity unauthenticated vector makes reliable exploitation straightforward once the parameter is known.