CVE-2024-5709: WPBakery Page Builder RCE Vulnerability

CVE-2024-5709 Overview

CVE-2024-5709 is a Local File Inclusion (LFI) vulnerability in the WPBakery Visual Composer plugin for WordPress. The flaw affects all versions up to and including 7.7 and stems from unsafe handling of the layout_name parameter. Authenticated attackers with Author-level access or higher, and with post permissions granted by an Administrator, can include and execute arbitrary files on the server. Successful exploitation enables execution of arbitrary PHP code, bypass of access controls, disclosure of sensitive data, and code execution when combined with uploads of images or other file types that pass basic validation.

Critical Impact
Authenticated attackers can achieve remote code execution on WordPress servers running WPBakery Visual Composer 7.7 or earlier by including attacker-controlled files through the layout_name parameter.

Affected Products

WPBakery Page Builder (Visual Composer) plugin for WordPress
All versions up to and including 7.7
WordPress sites where Authors or higher have post permissions granted by an Administrator

Discovery Timeline

2024-08-06 - CVE-2024-5709 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5709

Vulnerability Analysis

The vulnerability is a Local File Inclusion issue tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). The layout_name parameter is passed to a file inclusion routine without sufficient sanitization or allow-listing. An attacker can supply a path that traverses outside the intended template directory and points to arbitrary files on the server.

When the included file contains PHP, the WordPress runtime executes it in the context of the web server user. This turns any writable location or previously uploaded artifact into an execution primitive. Attackers commonly abuse this pattern to weaponize uploaded images, log files, or session data that contain injected PHP payloads.

Exploitation requires authentication at the Author level or above with post permissions granted by an Administrator. The barrier is low in multi-author environments, membership sites, and any deployment that provisions contributor-style roles.

Root Cause

The plugin accepts the layout_name request parameter and constructs a filesystem path used for template inclusion without validating that the resolved path stays within the intended template directory. Missing canonicalization and lack of an allow-list permit ../ traversal sequences and absolute paths.

Attack Vector

The attack is remote and authenticated. An attacker with Author-level access sends a crafted request that supplies a manipulated layout_name value pointing to a local file. The server includes and executes the referenced file, yielding arbitrary PHP execution when the target file contains PHP code. See the Wordfence Vulnerability Advisory for additional context.

Detection Methods for CVE-2024-5709

Indicators of Compromise

Requests containing the layout_name parameter with path traversal sequences such as ../, encoded variants like %2e%2e%2f, or absolute filesystem paths.
Unexpected PHP execution originating from the WordPress uploads directory or from files not part of the plugin distribution.
New or modified PHP files under wp-content/uploads/ following requests to WPBakery endpoints.
Outbound network connections initiated by the web server process shortly after WPBakery template rendering activity.

Detection Strategies

Inspect web server and WAF logs for requests to WPBakery handlers that include the layout_name parameter with suspicious values.
Monitor file integrity on the WordPress installation to detect newly created or altered PHP files in uploads and cache directories.
Correlate authenticated sessions of Author-level accounts with template rendering activity to spot anomalous inclusion patterns.

Monitoring Recommendations

Audit WordPress user roles and revoke Author-level or higher access that is not strictly required.
Enable verbose logging on the WordPress application and forward events to a centralized SIEM for behavioral analysis.
Alert on process lineage where the web server spawns shells, curl, wget, or other post-exploitation binaries.

How to Mitigate CVE-2024-5709

Immediate Actions Required

Update WPBakery Page Builder (Visual Composer) to a version later than 7.7 that addresses the LFI in the layout_name parameter.
Review and reduce the number of Author-level and higher accounts, and remove post permissions that are not operationally required.
Rotate credentials for accounts that had Author-level or higher access during the exposure window.
Scan the WordPress filesystem for unauthorized PHP files, particularly under wp-content/uploads/.

Patch Information

Verify the current fixed release on the WPBakery Official Site and consult the Wordfence Vulnerability Advisory for advisory details. Apply the patched version through the WordPress plugin manager or by replacing the plugin files with the vendor-provided update.

Workarounds

Restrict Author-level and higher roles until the patch can be applied, and disable the plugin on sites where it is not actively used.
Deploy WAF rules that block traversal sequences (../, encoded equivalents) and absolute paths in the layout_name parameter.
Enforce filesystem permissions so the web server user cannot execute PHP files in the uploads directory.

bash

# Example nginx rule to block traversal in layout_name
if ($arg_layout_name ~* "(\.\./|\.\.\\|%2e%2e|/etc/|/proc/)") {
    return 403;
}

# Deny PHP execution in the uploads directory
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}