CVE-2026-12227 is a critical (CVSS 9.8) local file inclusion flaw in the Visual Composer Website Builder WordPress plugin. It lets attackers who are not logged in include and execute arbitrary files on the server.
What Is It
CVE-2026-12227 is a Local File Inclusion vulnerability (CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program). It affects the Visual Composer Website Builder plugin for WordPress. The flaw is reached through the vcv-template parameter.
Wordfence reported it, and it was published to NVD on 2026-09-24. Its NVD status is currently "Received," so NVD has not completed its own analysis.
Why It Matters
According to the NVD description, attackers who are not logged in can include and execute arbitrary files on the server. Any PHP code in those files will run. This can be used to:
- Bypass access controls
- Obtain sensitive data
- Achieve code execution where images or other "safe" file types can be uploaded and then included
The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This means the flaw can be exploited over the network with low complexity, and it needs no privileges and no user action. A successful attack has high impact on confidentiality, integrity and availability. The base score is 9.8 (CRITICAL).
Exploitation status: As of publication, CVE-2026-12227 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. This means CISA has not confirmed active exploitation. Neither the NVD record nor the Wordfence advisory reports exploitation in the wild.
What's Vulnerable
- Vendor: visualcomposer
- Product: Visual Composer Website Builder (WordPress plugin)
- Affected versions: All versions up to and including 45.16.0
The NVD record does not yet list any CPE entries, which fits its "Received" status.
Patch Status
The NVD record lists a WordPress plugin repository changeset (3619572) as a reference. The changeset is likely related to a fix, but the NVD record does not say what it changes. It also does not name a fixed release version. We have not independently confirmed that this changeset fully fixes the vulnerability.
Sites running Visual Composer Website Builder 45.16.0 or earlier should update to the latest available release. Check the vendor's release notes or the Wordfence advisory to confirm that the version you install is listed as patched. Because the CVE is not in the CISA KEV catalog, there is no KEV-mandated action or due date.