CVE-2023-1274 | BDVDB-2026-200282 Detail

Pricing Tables For WPBakery Page Builder (formerly Visual Composer)

Description#

The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks

Impact#

No impact statement in the source data.

Weaknesses#

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References#

https://wpscan.com/vulnerability/267acb2c-1a95-487f-a714-516de05d2b2f

Exploit#

https://wpscan.com/vulnerability/267acb2c-1a95-487f-a714-516de05d2b2f

History#

Version 12023-04-17Record published in the CVE List.
Version 22025-03-03Most recent update recorded in the CVE List.