Name of the Vulnerable Software and Affected Versions:
WPBakery Visual Composer plugin for WordPress versions up to, and including, 7.7
Description:
The issue allows authenticated attackers with Author-level access and above, and with post permissions granted by an Administrator, to include and execute arbitrary files on the server via the `layout name` parameter. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Recommendations:
For versions up to, and including, 7.7, consider disabling the `layout name` parameter until a patch is available to prevent the inclusion and execution of arbitrary files. Restrict access to file uploads and execution to minimize the risk of exploitation.