The vulnerability arises from improper validation of the vcv-template parameter, allowing unauthenticated local file inclusion. An attacker can include and execute arbitrary files on the server, enabling PHP code execution. This can be leveraged to bypass access controls, exfiltrate sensitive data, and achieve full code execution if an attacker can upload or reference files such as images that are processed by the plugin.

The flaw affects the Visual Composer Website Builder plugin for WordPress from all releases up to and including version 45.16.0. Any environment that hosts that plugin and is accessible without authentication is at risk. The version requirement applies to all prior releases, regardless of WordPress version.

The CVSS score of 9.8 signals a critical impact. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of mitigation does not reduce risk. An unauthenticated attacker can trigger the inclusion by sending a crafted request to the vulnerable endpoint using the vcv-template parameter. Once included, malicious PHP code can run with the privileges of the web server, leading to total compromise of the affected host.