CVE-2026-12227

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

September 24, 2026

Last Seen

September 27, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical LFI Vulnerability in Visual Composer Exposed78.0

A critical unauthenticated Local File Inclusion (LFI) vulnerability, CVE-2026-12227, has been identified in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to 45.16.0. The flaw allows attackers to include and execute arbitrary files on the server through the vcv-t...

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches72.9

Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular pl...