The vulnerability is a missing Authorization flaw that allows an attacker to bypass the Visual Composer Website Builder plugin’s predefined security levels. By exploiting this weakness, an attacker could potentially gain unauthorized access to administrative functionalities or modify site content beyond their intended scope. The flaw maps to CWE‑862 and can compromise the confidentiality, integrity, or availability of the site depending on the privileges obtained.

This issue affects the WordPress Visual Composer Website Builder plugin for all releases up through 45.16.3. Any WordPress site that has installed a version of the plugin that meets or is lower than this threshold is vulnerable. All affected installations contain the same code path that imposes inadequate access control, regardless of the site configuration.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. The plugin is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. The likely attack vector is via the plugin’s administrative interface, and the lack of proper authentication checks makes exploitation relatively easy for authenticated or even unauthenticated users with access to the site’s backend. Organisations with this plugin should treat the presence of the vulnerability as a non‑critical but actionable risk that merits prompt remediation.