CVE-2026-12227 — Visual Composer Website Builder ≤ 45.16.0 Unauthenticated LFI
September 25, 2026 · 419 views
Unauthenticated local file inclusion in **Visual Composer Website Builder** (≤ 45.16.0) via the **`vcv-template`** parameter (public Wordfence/NVD discussion).
Description
Overview
CVE-2026-12227 is an unauthenticated local file inclusion in Visual Composer Website Builder for WordPress (≤ 45.16.0). The vcv-template code path is reported to allow inclusion of attacker-influenced template paths.
Impact
LFI can leak sensitive files (wp-config.php, environment files) and may combine with log poisoning or other tricks toward code execution.
Remediation
Upgrade Visual Composer Website Builder beyond the patched release cited in Wordfence/NVD entries.
Legal and ethical use
Use bundled tools only on WordPress sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.
References
- Look up the CVE ID on NVD and the CVE Program for official records.
- Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.
Related PoCs
Same platform, vendor, or tags — explore more write-ups on Pocbit.
- WordPressCVE-2026-87902critical
CVE-2026-87902 — WordPress Core get_page_template() Unauthenticated LFI → RCE (PEAR chain)
WordPress core 4.7.0–7.1.1: pagename from POST used in get_page_template() without validate_file(); page-templates/ traversal + PEAR gadget → RCE. GHSA-7hp8-65ch-5whp, CVSS 4.0 9.8, CWE-22. Fixed 7.1.2+ (backports 6.8.10, 7.0.6). Python mass scanner: --check, --rce, --shell. Upstream: MRdark-ops/CVE-2026-87902 (HackfutSecRoot).
- WordPressCVE-2026-18143critical
CVE-2026-18143 — Addify Request a Quote for WooCommerce Unauthenticated File Upload
Unauthenticated arbitrary file upload (CWE-434, CVSS 9.8 Critical) in Request a Quote for WooCommerce ≤ 2.9.2 via public AJAX afrfq_submit_quote_via_popup — unsafe move_uploaded_file() with attacker-controlled .php names into web-accessible RFQ temp storage. Requires popup quote rule on the storefront.
- WordPressCVE-2026-19660critical
CVE-2026-19660 — Divi Membership (DiviEngine) ≤2.3.0 paypal_param Authentication Bypass
DiviEngine Divi Membership ≤2.3.0: process_paypal_callback on init trusts base64 paypal_param GET without PayPal/IPN validation → wp_set_current_user + wp_set_auth_cookie as arbitrary user ID (incl. admin). PayPal gateway class loads even when disabled. CVSS 9.8 Critical (CWE-287). Python PoC: check/exploit, cookie export, mass scan.
- WordPressCVE-2026-82901critical
CVE-2026-82901 — Ultra Addons for Contact Form 7 Unauthenticated File Upload
Unauthenticated arbitrary file upload (CWE-434, CVSS 3.1 9.8 Critical) in Ultra Addons for Contact Form 7 (Themefic) ≤ 3.5.50 via uacf7_wpcf7_mail_components in the PDF Generator addon — signature field copies files to wp-content/uploads/uacf7-uploads/ with weak validation. Requires PDF Generator enabled on a form with uacf7_signature. Fixed in 3.5.51+.