WordPress Plugin Vulnerabilities

Ultimate Addons for WPBakery Page Builder < 3.19.15 - Authenticated(Contributor+) Local File Inclusion

Description

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.19.14. This makes it possible for authenticated attackers, with contributor access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Affects Plugins

Plugin icon
Ultimate_VC_Addons
Fixed in 3.19.15
Plugin icon
ultimate_vc_addons
Fixed in 3.19.15

References

CVE
CVE-2023-46205
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5222ce69-ac9f-4bb0-9832-8cdff1f8b078

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
564fc1aa-ed32-4748-b024-7523e3f3bd3a

Timeline

Publicly Published
2023-10-19 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-01-12 (about 2 years ago)

Other

Published
Title
Published
2025-07-01
Title
Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
Published
2018-04-06
Title
WP Background Takeover <= 4.1.4 - Directory Traversal
Published
2025-08-06
Title
Prevent files / folders access < 2.6.1 - Authenticated (Subscriber+) Path Traversal
Published
2025-03-21
Title
Export and Import Users and Customers < 2.6.3 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
Published
2026-01-05
Title
FastDup < 2.7.1 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter