CVE-2026-12227: Visual Composer Website Builder RCE Vulnerability

CVE-2026-12227 Overview

The Visual Composer Website Builder plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 45.16.0. The flaw resides in handling of the vcv-template parameter, which is processed without sufficient validation. Unauthenticated attackers can include and execute arbitrary files on the server, leading to arbitrary PHP code execution. Attackers can bypass access controls, read sensitive files, and achieve remote code execution when combined with uploads of ostensibly safe file types such as images. The vulnerability is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Unauthenticated remote attackers can execute arbitrary PHP code on affected WordPress servers, resulting in full site compromise.

Affected Products

Visual Composer Website Builder plugin for WordPress
All versions up to and including 45.16.0
WordPress sites with the plugin active and reachable from the network

Discovery Timeline

2026-09-24 - CVE-2026-12227 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-12227

Vulnerability Analysis

The plugin accepts a user-supplied vcv-template parameter and passes it into a PHP include or require statement without properly restricting the resolved path. Because no authentication is required to reach the vulnerable code path, any unauthenticated visitor can supply a crafted parameter value. Successful exploitation yields PHP code execution in the context of the web server user. Attackers commonly chain this primitive with WordPress media uploads, embedding PHP payloads inside files whose extensions pass server-side checks.

Root Cause

The root cause is improper neutralization of filename input used in a PHP include statement, classified as CWE-98. The vcv-template parameter flows directly into a filesystem include without canonicalization, allow-list validation, or extension enforcement. See the WordPress Plugin Change Log for the specific code change that addresses the issue.

Attack Vector

Exploitation occurs over the network against the WordPress HTTP endpoint exposed by the plugin. An attacker issues a request containing a vcv-template value referencing a local file path, including uploaded media or server-side files. When the server resolves the include, any PHP within the referenced file executes. Refer to the Wordfence Vulnerability Report for additional technical context.

No verified proof-of-concept code is published in the referenced advisories.
See the Wordfence advisory and the WordPress plugin changeset for details.

Detection Methods for CVE-2026-12227

Indicators of Compromise

HTTP requests containing the vcv-template parameter with values pointing to local paths, traversal sequences such as ../, or uploaded media filenames.
Unexpected PHP execution originating from wp-content/uploads/ or other writable directories.
Creation of new administrator accounts, PHP webshells, or scheduled tasks shortly after suspicious plugin requests.
Outbound connections from the web server to unknown hosts following requests to Visual Composer endpoints.

Detection Strategies

Inspect web server and WordPress access logs for vcv-template parameters containing path separators, null bytes, or references to uploaded files.
Alert on PHP processes spawned by the web server that read or write files outside the plugin directory.
Compare installed Visual Composer plugin versions across WordPress sites against the fixed release to identify unpatched hosts.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and build detections for abnormal vcv-template values.
Monitor file integrity in wp-content/uploads/, plugin directories, and theme directories for new or modified PHP files.
Track outbound network connections from PHP worker processes to flag post-exploitation command-and-control activity.

How to Mitigate CVE-2026-12227

Immediate Actions Required

Update the Visual Composer Website Builder plugin to a version later than 45.16.0 on all WordPress installations.
Audit WordPress sites for unauthorized administrator accounts, modified files, and unknown PHP files in upload directories.
Rotate WordPress administrator credentials, API keys, and database passwords if compromise is suspected.

Patch Information

The vendor addressed the Local File Inclusion issue in a release following 45.16.0. The fix is reflected in the WordPress Plugin Change Log changeset 3619572. Review the Wordfence Vulnerability Report for vendor and detection details.

Workarounds

Deactivate and remove the Visual Composer Website Builder plugin until patching is complete.
Deploy a web application firewall rule to block requests containing suspicious vcv-template values, including path traversal sequences and references to uploaded files.
Restrict file upload capabilities to trusted roles and disable PHP execution in wp-content/uploads/ through web server configuration.

bash

# Example Nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}