EUVD-2026-53172
GHSA-ffxc-x9pw-3698
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated network-reachable endpoint requiring no special conditions; impact bounded to wp_options writes and uncontrolled outbound connection abuse with no confidentiality exposure.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the Layouts_WPB_Remote::template_sync() callback registered via wp_ajax_nopriv_handle_sync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}) and to write the JSON-decoded responses verbatim into the site's wp_options table via set_transient() - at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.
AnalysisAI
Unauthenticated SSRF-adjacent resource abuse in Layouts for WPBakery (all versions ≤ 1.1.3) allows any remote attacker to force the WordPress host to issue unlimited outbound HTTP requests to the plugin vendor's external REST API and write the decoded JSON responses directly into the site's wp_options database table. The missing capability check on the wp_ajax_nopriv_handle_sync action (CWE-862) exposes this endpoint to every unauthenticated client with no nonce verification or rate limiting in place. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the plugin being installed and active: any unauthenticated HTTP client can POST to wp-admin/admin-ajax.php with action=handle_sync on any WordPress site running the plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) accurately reflects the threat model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scripted to send continuous unauthenticated HTTP POST requests to https://target-site.com/wp-admin/admin-ajax.php with body action=handle_sync causes the WordPress server to repeatedly fetch data from the vendor API and execute database writes in a tight loop. At sustained high rate, this degrades MySQL performance through transient table bloat, may trigger connection pool exhaustion on shared hosting environments, and can cause the victim server's IP to be blocked by the vendor's API endpoint - silently breaking template synchronization for all legitimate administrators. … |
| Remediation | Update the Layouts for WPBakery plugin to the version incorporating the fix committed at SVN changeset 3543686 (https://plugins.trac.wordpress.org/changeset?new=3543686%40layouts-for-wpbakery%2Ftrunk&old=3543685%40layouts-for-wpbakery%2Ftrunk); a precise patched release version number was not independently confirmed from available data, so verify the installed version against the WordPress plugin repository changelog after updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today