Dashboard / CVE-2026-110516

CVE-2026-110516

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 56/100
Published: 2026-11-10 Modified: 2026-11-11 First seen: 2026-11-10 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: High
I: Low
A: None

Description

The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown All in One Addons For WPBakery Page Builder (formerly Visual Composer) 0
Unknown All in One Addons For WPBakery Page Builder (formerly Visual Composer) 0

References & Advisories (1)

Bug Bounty Relevance

56 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002700
Percentile 19.3%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00270
2026-11-12
0.00270
2026-11-10
0.00158

Intelligence Sources

mitre ref →
nvd ref →

External Links