Vulnerability record/PUBLISHED/Published Nov 10, 2026 06:00:04 UTC
CVE-2026-110516
The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 10, 2026 06:00:04 UTC
PublishedNov 10, 2026 06:00:04 UTC
ReservedOct 14, 2026 11:43:23 UTC
Credits
- JunHee CHO
- WPScan