High · published December 13, 2025
⚡ A sneaky Local File Inclusion vulnerability lurks in the Extensive VC Addons for WPBakery plugin, making it possible for attackers to execute any PHP code on the server! 🔥 Think of it like a delivery driver who accepts any package without checking the label — if they ignore the address, who knows what malicious contents could be let in! An unauthenticated attacker could exploit this vulnerability to include and execute arbitrary PHP files on your server, potentially compromising your entire website. This could lead to data leakage, unauthorized access, or even complete control over your WordPress installation — absolutely devastating!
Think of it like a delivery driver who accepts any package without checking the label — if they ignore the address, who knows what malicious contents could be let in! This vulnerability arises from the insufficient path normalization and validation of the user-supplied `shortcode_name` parameter within the `extensive_vc_init_shortcode_pagination` AJAX action. As a result, an attacker can manipulate this to include unintended files.
An unauthenticated attacker could exploit this vulnerability to include and execute arbitrary PHP files on your server, potentially compromising your entire website. This could lead to data leakage, unauthorized access, or even complete control over your WordPress installation — absolutely devastating! To mitigate this risk, immediately update to version 1.9.2 of the Extensive VC Addons plugin. Additionally, review your server settings to ensure strict file access controls and validate input parameters to avoid unauthorized file inclusions. You've got this! By taking these steps, you can secure your site and keep those sneaky attackers at bay! 🛡️