CVE-2024-13592: Team Builder for WPBakery RCE Vulnerability

CVE-2024-13592 Overview

CVE-2024-13592 affects the Team Builder For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress. All versions up to and including 1.0 contain a Local File Inclusion (LFI) flaw in the team-builder-vc shortcode. Authenticated users with Contributor-level access or above can include and execute arbitrary files on the server. Attackers can use the flaw to run PHP code, bypass access controls, exfiltrate sensitive data, or achieve remote code execution when a writable file such as an image can be uploaded and then included. The vulnerability is classified under CWE-98, improper control of filename for include/require statements in PHP.

Critical Impact
Authenticated Contributors can execute arbitrary PHP on the underlying WordPress host by abusing the vulnerable shortcode.

Affected Products

Webdevocean Team Builder For WPBakery Page Builder plugin for WordPress
All plugin versions up to and including 1.0
WordPress sites exposing the team-builder-vc shortcode to Contributor-level users

Discovery Timeline

2025-02-19 - CVE-2024-13592 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-13592

Vulnerability Analysis

The plugin registers the team-builder-vc shortcode and accepts a user-controlled attribute that is passed into a PHP include or require statement without validation. Because WordPress shortcodes can be rendered from post content, any user permitted to author posts can inject the shortcode with an attacker-supplied path. The path resolves against the server filesystem, and any file matching that path is executed as PHP.

This is a textbook Local File Inclusion issue mapped to CWE-98. Because inclusion runs in the WordPress PHP context, executed code inherits web server privileges and full database access. The Exploit Prediction Scoring System places the vulnerability around the 56th percentile, indicating moderate likelihood of exploitation activity.

Root Cause

The root cause is unsanitized use of a shortcode attribute in a PHP file inclusion call within plugin.class.php. The plugin does not restrict the attribute to an allowlist, does not enforce a base directory, and does not strip traversal sequences such as ../. Any resolvable path on the filesystem, including uploaded media, becomes a valid include target.

Attack Vector

An attacker authenticates to WordPress with at least Contributor privileges. The attacker creates or edits a post that contains the team-builder-vc shortcode with a crafted path attribute. When the post is previewed or rendered, WordPress invokes the shortcode handler, which includes the specified file. If the attacker first uploads an image file containing embedded PHP, they can include it through the shortcode to achieve arbitrary PHP execution. See the WordPress plugin source at plugin.class.php line 55 and the Wordfence Vulnerability Intelligence entry for technical detail.

No verified public proof of concept is currently available, so exploitation specifics are described in prose rather than shown as code.

Detection Methods for CVE-2024-13592

Indicators of Compromise

Post or page content containing the team-builder-vc shortcode with unexpected file, path, or template attributes referencing paths outside the plugin directory.
Uploads in wp-content/uploads/ with image extensions but PHP tags such as <?php present in file bytes.
Unexpected outbound network connections or shell processes spawned by the PHP-FPM or Apache worker serving WordPress.
New administrator accounts, modified wp-config.php, or webshells written into theme and plugin directories following Contributor logins.

Detection Strategies

Scan the wp_posts table for post content containing the team-builder-vc shortcode and inspect attribute values for path traversal patterns.
Enable PHP open_basedir violation logging and alert on include, require, or file_get_contents calls resolving outside expected plugin paths.
Baseline the plugin file set with integrity monitoring and flag any Contributor account that authors posts referencing filesystem paths.

Monitoring Recommendations

Log every Contributor and Author post creation event and correlate with the presence of shortcodes that reference file paths.
Monitor WordPress access logs for requests to admin-ajax.php and post preview endpoints followed by unusual PHP error entries.
Alert on any web-shell signatures or execution of system binaries such as sh, bash, or cmd.exe from PHP worker processes.

How to Mitigate CVE-2024-13592

Immediate Actions Required

Deactivate and remove the Team Builder For WPBakery Page Builder plugin until a fixed release is confirmed by the vendor.
Audit all Contributor, Author, and Editor accounts and disable any that are unused, shared, or unverified.
Review wp-content/uploads/ for files with double extensions or embedded PHP, and remove any that are not legitimate media.
Rotate WordPress administrator passwords, database credentials in wp-config.php, and any API keys stored in the database.

Patch Information

At the time of the NVD entry, no vendor-supplied patched version is listed for Team Builder For WPBakery Page Builder above 1.0. Site owners should track the plugin page on the WordPress plugin directory and the Wordfence advisory for a fixed release announcement.

Workarounds

Remove or restrict the plugin by deactivating it site-wide and deleting the plugin directory from wp-content/plugins/.
Restrict post authoring capabilities so that untrusted users are not assigned Contributor or higher roles.
Deploy a web application firewall rule to block requests containing the team-builder-vc shortcode with path traversal sequences such as ../ or absolute paths.
Configure PHP open_basedir and disable_functions to constrain what the WordPress process can include and execute.

bash

# Example: constrain PHP includes to the WordPress document root via php.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"

# Remove the vulnerable plugin from disk
wp plugin deactivate team-builder-for-wpbakery-page-builder
rm -rf /var/www/html/wp-content/plugins/team-builder-for-wpbakery-page-builder