What happened
Unauthenticated LFI in Visual Composer via vcv-template validation flaw.
Affected versions
Unknown product: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
SploitusUnauthenticated LFI in Visual Composer via vcv-template validation flaw.Hassham12026-09-24T17:48:27VerifiedSploitusUnauthenticated LFI in Visual Composer Website Builder ≤ 45.16.0 via vcv-template param.murrez2026-09-24T17:12:08VerifiedHassham1/CVE-2026-12227-visualcomposer-lfi-pocUnauthenticated LFI in Visual Composer via vcv-template validation flaw.Hassham12026-09-24T17:48:27Verifiedmurrez/CVE-2026-12227Unauthenticated LFI in Visual Composer Website Builder ≤ 45.16.0 via vcv-template param.murrez2026-09-24T17:12:08VerifiedSploitusProof-of-concept exploit for CVE-2026-12227. CVSS 9.8.Sploitus index2026-09-27T09:03:34+00:00Candidatebe-keb/CVE-2026-12227Unauthenticated LFI in Visual Composer Website Builder up to 45.16.0 via vcv-template.be-keb2026-09-27T09:10:13VerifiedSploitusProof-of-concept exploit for CVE-2026-12227. CVSS 9.8.Sploitus index2026-09-30T18:20:31+00:00CandidateSource timeline
Discovered through SploitusView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.