CVE-2024-13592
Published: 19 February 2025
Description
The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'team-builder-vc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Security Summary
CVE-2024-13592 is a Local File Inclusion vulnerability affecting the Team Builder For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress in all versions up to and including 1.0. The flaw exists in the 'team-builder-vc' shortcode, which enables the inclusion and execution of arbitrary files on the server. It is classified under CWE-98 with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to include arbitrary files, leading to the execution of PHP code within those files. Potential impacts include bypassing access controls, obtaining sensitive data, or achieving code execution, particularly when attackers upload "safe" file types like images that contain exploitable PHP payloads.
Advisories and additional details are available from Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7e8d76-a461-4b0b-a312-c6ea4b8ac375?source=cve and the plugin source code at https://plugins.trac.wordpress.org/browser/team-builder-for-wpbakery-page-builder/tags/1.0/plugin.class.php#L55.
Details
- CWE(s)