Lucene search
WPScanCVELIST:CVE-2023-0159HistoryFeb 13, 2023 - 2:32 p.m.
CVE-2023-0159 Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
2023-02-1314:32:03
WPScan
www.cve.org
3
cve-2023-0159; extensive vc addons; wpbakery page builder; unauthenticated rce; wordpress plugin; arbitrary files.
EPSS
0.015
Percentile
87.3%
The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Extensive VC Addons for WPBakery page builder",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "1.9.1"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
prion
prion
Design/Logic Flaw
2023-02-13 15:15:00
nuclei
nuclei
Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
2024-03-31 07:25:33
cve
cve
CVE-2023-0159
2023-02-13 15:15:20
nvd
nvd
CVE-2023-0159
2023-02-13 15:15:20
githubexploit
githubexploit
Exploit for CVE-2023-0159
2023-09-11 11:36:35