# CVE-2026-12227

Unauthenticated LFI in Visual Composer plugin enabling remote code execution.

- Page: https://www.vulneraibility.com/cve/CVE-2026-12227
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 2.77% (percentile 86.4)
- Unvetted proof-of-concept code on GitHub: 4 GitHub proofs of concept · 1 Nuclei template (first 2026-09-24)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-24)
- Weakness: CWE-98
- Published: 2026-09-24

## Affected versions

- visualcomposer Visual Composer Website Builder: affected <= 45.16.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated local file inclusion allowing execution of arbitrary PHP, data access, access‑control bypass, and full site compromise.

## Action

Immediate action required

## Recommendation

Upgrade plugin to the patched version (>45.16.0) or remove it; scan and remediate compromised sites.

## References

- [other] https://www.wordfence.com/threat-intel/vulnerabilities/id/486c1c7c-5a66-42d3-85b0-13ce52a16ed1?source=cve
- [other] https://plugins.trac.wordpress.org/changeset/3619572/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.