CVE-2026-110516: All in One Visual Composer Addons <= 1.2 - Contributor+ LFI via vca_tabs_style Shortcode Attribute
The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a WordPress account with the contributor role or a higher-privileged role. Unauthenticated visitors are not identified as able to exploit it by the available information.
What is the potential impact of successful exploitation?
A contributor-level or higher user could cause arbitrary local PHP files on the server to be included and executed. This can expose or execute server-side code available through local file paths.
Which plugin versions are affected?
The issue affects All in One Addons For WPBakery Page Builder, formerly Visual Composer, through version 1.2.