CVE-2026-106596: WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability

Q: Which installations are affected?

Visual Composer Website Builder versions through 45.16.3 are affected. The available data does not identify a lower affected version boundary.

Q: Does exploitation require authentication or user interaction?

No. The CVSS vector indicates the vulnerability is remotely exploitable over the network with no privileges required and no user interaction.

Q: What is the potential impact of successful exploitation?

The reported impact is limited to confidentiality, with low confidentiality impact and no reported integrity or availability impact.

Published Oct 8, 2026

Updated

Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Composer Website Builder: from n/a through 45.16.3.

Affected Software

1 affected component

Visual Composer Visual Composer Website Builder<=45.16.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Visual Composer Website Builder to a version that resolves this vulnerability.
Fixed in 45.16.4

Event History

Oct 8, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Visual Composer Website Builder versions through 45.16.3 are affected. The available data does not identify a lower affected version boundary.

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates the vulnerability is remotely exploitable over the network with no privileges required and no user interaction.

What is the potential impact of successful exploitation?

The reported impact is limited to confidentiality, with low confidentiality impact and no reported integrity or availability impact.

CVE-2026-106596: WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or user interaction?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or user interaction?

What is the potential impact of successful exploitation?