What is the CVSS score of CVE-2026-65568?

CVE-2026-65568 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Visual Composer Website Builder CVE-2026-65568

EUVD-2026-49239 MEDIUM

Missing Authorization (CWE-862)

2026-07-27 Patchstack

GHSA-8pw6-rj96-2r94

WordPress Authentication Bypass Visual Composer Website Builder Wordpress Plugin

5.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

vuln.today AI

5.0 MEDIUM

PR:L as low-privilege auth required; S:C because impact extends to site content beyond plugin.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 15:04 vuln.today

CVE Published

Jul 27, 2026 - 13:59 cve.org

MEDIUM 5.0

DescriptionCVE.org

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

AnalysisAI

Broken access control in Visual Composer Website Builder plugin for WordPress allows authenticated attackers with low privileges (e.g., subscriber) to modify site content by bypassing authorization checks on restricted endpoints. No public exploit has been identified, and the SSVC decision framework indicates no current exploitation, making this a low-priority issue despite a CVSS 5.0 score.

Technical ContextAI

The vulnerability is a missing authorization flaw (CWE-862) in the Visual Composer Website Builder plugin for WordPress. WordPress plugins often use capability checks to restrict access to administrative functions, but this plugin fails to enforce proper authorization for certain actions, allowing users with lower roles (like subscribers) to access functionality intended for editors or administrators. The CPE cpe:2.3:a:visual_composer:visual_composer_website_builder:*: corresponding to all versions up to 45.15.0. The attack vector is network-based, requires low complexity, and authenticated low-privilege access, with a scope change indicating the impact extends beyond the vulnerable plugin to the site itself.

RemediationAI

Upgrade the Visual Composer Website Builder plugin to a patched version (e.g., 45.15.1 or later) as recommended by the vendor. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-plugin-45-15-0-broken-access-control-vulnerability provides details. As a workaround, restrict registration of low-privilege accounts or use a WordPress security plugin to enforce role-based access control on plugin endpoints, though this may break plugin functionality.