CVE-2026-12227
validatedZero produced an exploit or a check.GHSA-3q44-ppmv-jh7f ↗EUVD-2026-85839 ↗
description
Visual Composer Website Builder for WordPress through version 45.16.0 is affected by an unauthenticated local file inclusion flaw. An unauthenticated attacker may cause server-side files to be included, potentially exposing data, bypassing access controls, or executing PHP contained in included files. Exploitation requires a suitable server-side file to be accessible for inclusion.
mitigation
Disable or remove the affected plugin until the vendor provides a fixed release. Restrict untrusted file uploads and limit public access to sites where the plugin remains installed.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-09-24 09:27Zcve.org record for CVE-2026-12227
- 2026-10-08vulncheck_kev: trigger signal, started the run
- 2026-10-08 00:00Z
- 2026-10-11 23:40Znuclei-templates ships a detection
this entry in the feed
GET /api/v1/feed/CVE-2026-12227
{ "etk_id": "ETK-2026-1272", "cve_id": "CVE-2026-12227", "display_id": "CVE-2026-12227", "ghsa_id": "GHSA-3q44-ppmv-jh7f", "euvd_id": "EUVD-2026-85839", "status": "published", "anchor_state": "anchored", "title": "Local file inclusion in Visual Composer Website Builder", "summary": "Visual Composer Website Builder for WordPress through version 45.16.0 is affected by an unauthenticated local file inclusion flaw. An unauthenticated attacker may cause server-side files to be included, potentially exposing data, bypassing access controls, or executing PHP contained in included files. Exploitation requires a suitable server-side file to be accessible for inclusion.", "mitigation": "Disable or remove the affected plugin until the vendor provides a fixed release. Restrict untrusted file uploads and limit public access to sites where the plugin remains installed.", "vendor": "visualcomposer", "product": "visual_composer_website_builder", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 45.16.0" ], "ecosystem": null, "fixed_versions": [], "package_name": "Visual Composer Website Builder", "purl": null } ], "cwes": null, "cvss_score": 9.8, "cvss_src": "other", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epss_score": 0.0287, "epss_percentile": 0.8661, "epss_asof": "2026-10-20", "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.01932475, "t0_at": "2026-09-24T09:27:45.876000+00:00", "signals": { "check": { "at": "2026-10-11T23:40:47.095941+00:00", "days": 17.592375230798613, "is_lower_bound": false, "measured_at": "2026-09-24T09:27:45.876000+00:00", "url": null }, "kev": { "at": "2026-10-08T00:00:00+00:00", "days": 14, "is_lower_bound": false, "measured_at": "2026-09-24T09:27:45.876000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-12227" }, "public_poc": { "at": "2026-10-11T23:40:47.597981+00:00", "days": 17.59238104144676, "is_lower_bound": false, "measured_at": "2026-09-24T09:27:45.876000+00:00", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-12227.yaml" }, "trigger_signal": { "at": "2026-10-08T00:00:00+00:00", "days": 13.605719027777777, "is_lower_bound": false, "measured_at": "2026-09-24T09:27:45.876000+00:00", "url": "https://vulncheck.com/cve/CVE-2026-12227" } } }
published 2026-10-11 23:40Z
last change 2026-10-20 23:46Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.