ALL IN ONE ADDONS FOR WPBAKERY PAGE BUILDER · CVE-2026-110516 · Package
NO FIX YET · SEE WHAT TO DO
The All in One Addons for WPBakery Page Builder WordPress plugin, through version 1.2, does not validate a shortcode attribute before using it in a file path that is included and executed. An attacker with contributor-level WordPress access can include and run arbitrary local PHP files on the server.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
WordPress sites with the All in One Addons For WPBakery Page Builder plugin (slug all-in-one-visual-composer-addons) at version 1.2 or lower, where anyone holds a contributor role or above. The vca_tabs_style shortcode attribute is used to build a file path that is included and executed, so a contributor can run local PHP files on the server. Sites without the plugin, or without untrusted contributor-level accounts, can skip it.
Not affected if no-contributor-users, plugin-not-installed
Who cares lfi, php, wordpress, wpbakery
The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.