CVE-2026-110516 Details
Description
The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.
A local file inclusion vulnerability has been identified in the All in One Addons For WPBakery Page Builder WordPress plugin, affecting versions through 1.2. The vulnerability arises because the plugin fails to validate a shortcode attribute before using it to construct a file path that is included and executed. This flaw could enable users with contributor roles and above to include and execute arbitrary local PHP files on the server.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/bce6e184-91b9-444b-bb23-c356cf0488cd/ | [email protected] | AdvisoryExploitPartial Content |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| All in One Addons For WPBakery Page Builder | <= 1.2 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 10, 2026 | New CVE Received | [email protected] |