The Vulnerable plugin performs a local file inclusion without normalizing the user-supplied "shortcode_name" argument in an AJAX action, allowing an unauthenticated attacker to include and execute arbitrary PHP files present on the server. This capability turns the plugin into a conduit for arbitrary code execution, effectively giving the attacker full control over the affected WordPress installation. The weakness is identified as CWE-98.

All installations of the Extensive VC Addons for WPBakery page builder plugin up to and including version 1.9.1 are impacted. The vulnerability exists in the plugin code that runs within the WordPress environment and is triggered via standard plugin URLs accessed by any visitor.

The CVSS score of 8.1 reflects high severity, while the EPSS score of less than 1 percent indicates low exploitation probability as of the time of analysis. The defect is not listed in the CISA KEV catalog. The primary attack vector is the publicly available AJAX endpoint "extensive_vc_init_shortcode_pagination", which an attacker can call without authentication, supply a crafted "shortcode_name" value, and thereby include malicious server-side files. Only a component with file system write access or an attacker already able to place files on the web root would be fully exploited, but the LFI flaw itself allows arbitrary code execution if such files exist.