CVE-2026-106596: Visual Composer Auth Bypass Vulnerability

CVE-2026-106596 Overview

CVE-2026-106596 is a Missing Authorization vulnerability [CWE-862] in the Visual Composer Website Builder plugin for WordPress. The flaw affects all versions up to and including 45.16.3. Attackers can exploit incorrectly configured access control security levels to interact with plugin functionality that should require authentication or elevated privileges. The vulnerability is reachable over the network, requires no authentication, and no user interaction. Successful exploitation leads to limited disclosure of information handled by the plugin on affected WordPress sites.

Critical Impact

Unauthenticated remote attackers can access plugin functionality protected only by misconfigured access controls, enabling information disclosure from WordPress sites running Visual Composer Website Builder.

Affected Products

• Visual Composer Website Builder plugin for WordPress
• Versions from n/a through 45.16.3
• WordPress sites with the plugin installed and activated

Discovery Timeline

• 2026-10-08 - CVE-2026-106596 published to the National Vulnerability Database
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-106596

Vulnerability Analysis

The vulnerability resides in request handlers exposed by the Visual Composer Website Builder plugin. One or more endpoints perform their intended action without verifying that the caller has the required WordPress capability or nonce. An unauthenticated attacker sending a crafted HTTP request to the vulnerable endpoint receives a response that includes plugin-managed data. Because the plugin is used to build and edit site pages, exposed functionality can include design or configuration metadata that should only be reachable by authenticated editors.

The issue is categorized under CWE-862 (Missing Authorization). The impact is scoped to confidentiality, with no direct integrity or availability loss reported.

Root Cause

The root cause is the absence of a capability check (for example current_user_can()) or an improperly validated nonce on a plugin endpoint. The handler executes before access control is enforced, so requests from any source are honored. See the Patchstack WordPress Vulnerability Report for additional technical context.

Attack Vector

An attacker sends an HTTP or HTTPS request directly to the vulnerable AJAX or REST endpoint exposed by the plugin. No authentication, no user interaction, and no prior reconnaissance credentials are required. The attacker reads the response to collect data returned by the misprotected handler. The attack can be automated against any internet-facing WordPress site that runs an affected plugin version.

Detection Methods for CVE-2026-106596

Indicators of Compromise

• Unauthenticated HTTP requests to Visual Composer plugin endpoints under paths such as /wp-admin/admin-ajax.php with action=vc_* parameters or /wp-json/ routes registered by the plugin
• Repeated requests from the same source IP enumerating plugin actions without a valid session cookie
• Web server access logs showing 200 OK responses to plugin endpoints from clients that never authenticated

Detection Strategies

• Review WordPress and web server access logs for requests to plugin endpoints that lack an authenticated session identifier
• Deploy Web Application Firewall (WAF) rules that flag unauthenticated access to Visual Composer administrative actions
• Audit the plugin version using wp plugin list and alert on installations at version 45.16.3 or earlier

Monitoring Recommendations

• Forward WordPress access and PHP error logs to a centralized SIEM for correlation
• Alert on spikes in requests to admin-ajax.php with Visual Composer action parameters from non-authenticated sessions
• Monitor outbound data volumes from WordPress hosts for unexpected growth that may indicate scraping

How to Mitigate CVE-2026-106596

Immediate Actions Required

• Identify every WordPress instance running Visual Composer Website Builder at version 45.16.3 or earlier
• Update the plugin to a fixed release once published by the vendor
• If an update is unavailable, deactivate and remove the plugin until a patch is released
• Place vulnerable sites behind a WAF with rules that block unauthenticated access to plugin endpoints

Patch Information

No fixed version is listed in the published advisory data. Monitor the Patchstack WordPress Vulnerability Report and the vendor's plugin changelog for a release that addresses CVE-2026-106596. Apply the update across all WordPress environments once available.

Workarounds

• Restrict access to /wp-admin/admin-ajax.php and /wp-json/ plugin routes to authenticated sessions via WAF or reverse-proxy rules
• Enforce IP allow-listing for administrative endpoints on sites that do not serve a public editor interface
• Disable the Visual Composer plugin on production sites that do not actively require it until a patched version is deployed

# Example: block unauthenticated POSTs to Visual Composer AJAX actions via nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^vc_") {
        if ($http_cookie !~* "wordpress_logged_in") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}