A critical vulnerability in Visual Composer Website Builder allows unauthenticated attackers to execute arbitrary code on the server, posing a severe risk to system integrity and data confidentiality.

This is a Local File Inclusion vulnerability (CWE-98) triggered via the vcv-template parameter. Unauthenticated attackers can leverage this flaw to include and execute arbitrary files, including PHP code, which facilitates full system compromise.

The ability for an unauthenticated attacker to achieve remote code execution represents the highest level of risk to an organization. Successful exploitation could lead to total system takeover, unauthorized access to sensitive database information, and significant reputational damage. With a CVSS score of 9.8, this flaw is categorized as Critical and requires immediate remediation to prevent widespread impact.

Immediate Action: Restrict access to the affected plugin endpoints and monitor for updates from the vendor to apply the necessary security patch immediately upon release.

Proactive Monitoring: Review web server and WordPress access logs for suspicious requests containing the vcv-template parameter or attempts to traverse system directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious input in the vcv-template parameter to prevent exploitation attempts until a permanent patch is installed.

Public Exploit Available: Yes, two public proof-of-concept repositories exist on GitHub.

Given the critical severity of this vulnerability and the availability of public exploit code, organizations must prioritize the protection of their WordPress environments. If an update is not yet available, administrators should consider deactivating the plugin or applying robust WAF filtering as an emergency measure. Failure to address this flaw leaves the underlying infrastructure exposed to complete remote compromise.