The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 10 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server. | |
| Title | All in One Visual Composer Addons <= 1.2 - Contributor+ LFI via vca_tabs_style Shortcode Attribute | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-10T06:00:04.445Z
Reserved: 2026-10-14T11:43:23.236Z
Link: CVE-2026-110516
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T06:17:07.963
Modified: 2026-11-10T06:17:07.963
Link: CVE-2026-110516
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.