CVE-2023-0159

🗓️ 13 Feb 2023 14:32:03Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 97 Views🌐 WEB

The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 is vulnerable to CVE-2023-0159, allowing unauthenticated attackers to read arbitrary files from the host's file system

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerability of the Extensive VC Addons plugin of the WordPress content management system allows attackers to expose sensitive information that should be protected.	13 Feb 202400:00	–	bdu_fstec
Circl	CVE-2023-0159	11 Sep 202311:49	–	circl
CNNVD	WordPress plugin Extensive VC Addons for WPBakery page builder 路径遍历漏洞	13 Feb 202300:00	–	cnnvd
Cvelist	CVE-2023-0159 Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE	13 Feb 202314:32	–	cvelist
Exploit DB	Extensive VC Addons for WPBakery page builder 1.9.0 - Remote Code Execution (RCE)	19 Mar 202500:00	–	exploitdb
Nuclei	Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE	24 Jul 202606:28	–	nuclei
NVD	CVE-2023-0159	13 Feb 202315:15	–	nvd
OSV	CVE-2023-0159	13 Feb 202315:15	–	osv
Packet Storm	WordPress Extensive VC Addons for WPBakery Page Builder 1.9.0 Code Execution	24 Mar 202500:00	–	packetstorm
Patchstack	WordPress Extensive VC Addons for WPBakery page builder Plugin < 1.9.1 is vulnerable to Local File Inclusion	23 Jan 202300:00	–	patchstack

NVD

Vulners

Node

wprealize extensive_vc_addons_for_wpbakery_page_builderRange<1.9.1wordpress

[
  {
    "vendor": "Unknown",
    "product": "Extensive VC Addons for WPBakery page builder",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.9.1"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/239ea870-66e5-4754-952e-74d4dd60b809

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Unauthenticated attacker can coerce template loading to read arbitrary files and potentially achieve remote code execution via PHP filter chains.	CWE-22, CWE-94
options[template]	request body	wp-admin/admin-ajax.php	Unauthenticated attacker can coerce template loading to read arbitrary files and potentially achieve remote code execution via PHP filter chains.	CWE-22, CWE-94

17 Jun 2026 05:24Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

EPSS0.55736

In Wild