{"vulnerability": "cve-2026-12227", "sightings": [{"uuid": "6eeed55d-7a87-4009-be00-743c277582b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwazax65vk2u", "content": "CVE-2026-12227 - visual composer website builder\nThe Visual Composer Website Builder plugin for WordPress lets anyone on the internet cause the server to load files it should not. By sending a specially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#visualcomposer #CVE #infosec", "creation_timestamp": "2026-09-24T10:10:06.930465Z"}, {"uuid": "f2f145d3-15a8-49cc-98b2-920627491fdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12227", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117325550570551615", "content": "Visual Composer Website Builder plugin \u226445.16.0 hit by CRITICAL LFI (CVE-2026-12227). Unauthenticated attackers can execute arbitrary PHP files via 'vcv-template'. Patch unconfirmed. Mitigate & monitor now: https://radar.offseq.com/threat/cve-2026-12227-cwe-98-improper-control-of-filename-for-includerequire-statement-in-php-program-php-ed037e731eb4a3e7 #OffSeq #WordPress #Vuln #LFI", "creation_timestamp": "2026-09-24T10:30:28.496142Z"}, {"uuid": "2afcc085-c912-44b1-a2b4-25d3e2ab7fb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12227", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwb2ffhzta2w", "content": "CVE-2026-12227: Visual Composer Website Builder \u226445.16.0 faces CRITICAL LFI \u2014 remote attackers can gain code execution. Patch status unconfirmed; restrict access & monitor activity. Full details: https://radar.offseq.com/threat/cve-2026-12227-cwe-98-improper-control-of-filename-for-includerequire...", "creation_timestamp": "2026-09-24T10:30:30.729114Z"}, {"uuid": "3b40f7fa-4667-4665-8e3d-55a0f9a73519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwb7sf3xdg2u", "content": "\ud83d\udea8 CVE-2026-12227 \u2014 CVSS 9.8 CRITICAL\n\nThe Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-12227\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-24T12:07:14.823622Z"}, {"uuid": "5ee87da2-9e25-499f-b79b-685b14216e97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwbamk45uy24", "content": "\ud83d\udd34 CVE-2026-12227 - Critical (9.8)\n\nThe Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12227/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-24T12:21:53.304008Z"}, {"uuid": "045afa6e-e699-497e-bbdc-9aa55ec27daf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://t.me/GithubRedTeam/103268", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 17:12:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 (CVSS 9.8): WordPress Visual Composer Website Builder \u226445.16.0 \u2014 unauthenticated local file inclusion via vcv-template. Educational PoC only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T19:00:06.000000Z"}, {"uuid": "89caf823-3a81-4948-acdf-2f76316635d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://t.me/GithubRedTeam/103264", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227-visualcomposer-lfi-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 17:48:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 - Visual Composer <= 45.16.0 unauthenticated LFI via vcv-template (CVSS 9.8): Docker validation lab, safe-oracle PoC, nuclei template. Root cause: validate-then-mutate on the theme: prefix. Verified: vendor fix never landed - fires through 45.16.3 on WP <= 7.1.1; masked by WP 7.1.2 core gate.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T18:00:08.000000Z"}, {"uuid": "8885e693-aa14-4516-8ba3-6560dfe2dd8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103268", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 17:12:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 (CVSS 9.8): WordPress Visual Composer Website Builder \u226445.16.0 \u2014 unauthenticated local file inclusion via vcv-template. Educational PoC only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T19:00:06.000000Z"}, {"uuid": "5c409a31-da5a-44ae-9080-c837cf0a6781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103264", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227-visualcomposer-lfi-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 17:48:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 - Visual Composer <= 45.16.0 unauthenticated LFI via vcv-template (CVSS 9.8): Docker validation lab, safe-oracle PoC, nuclei template. Root cause: validate-then-mutate on the theme: prefix. Verified: vendor fix never landed - fires through 45.16.3 on WP <= 7.1.1; masked by WP 7.1.2 core gate.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T18:00:08.000000Z"}, {"uuid": "8523036d-33ef-4129-b878-d516e60123c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/qZC90S3reg2BYBoeaZDLMoqfl021M9e_UnMBthvWa2cdvlY", "content": "", "creation_timestamp": "2026-09-25T03:00:05.000000Z"}, {"uuid": "735c2ae6-9944-47d4-87a6-702a08209bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/XmZSdpY4T0rmzyootlW7VMaseMzYz4SaH1hTXJ2jQLx35-A", "content": "", "creation_timestamp": "2026-09-24T19:00:17.000000Z"}, {"uuid": "d3731f02-0ca6-4a36-9fdb-c5249f4d36a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "Telegram/qZC90S3reg2BYBoeaZDLMoqfl021M9e_UnMBthvWa2cdvlY", "content": "", "creation_timestamp": "2026-09-25T03:00:05.000000Z"}, {"uuid": "9fb8726a-f0e5-4355-a968-0e39d0ef5658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "Telegram/XmZSdpY4T0rmzyootlW7VMaseMzYz4SaH1hTXJ2jQLx35-A", "content": "", "creation_timestamp": "2026-09-24T19:00:17.000000Z"}, {"uuid": "12daa694-16c9-4ccc-81e1-068f3d60bf62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://t.me/GithubRedTeam/103511", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a be-keb\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 09:10:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-27T10:00:08.000000Z"}, {"uuid": "e0c44fc8-4358-472f-b15a-ba370d07d22b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-12227.yaml", "content": "", "creation_timestamp": "2026-09-25T02:01:53.000000Z"}, {"uuid": "d7dc1973-8f49-41ef-b921-4289d80fdd34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "content": "", "creation_timestamp": "2026-09-27T21:00:04.000000Z"}, {"uuid": "d9a63071-0e14-45b2-8ef4-414e98dca7d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/Xs5RSNf8dUoer362h3C47eE9d4XRs66xIhTCunAO4l08ziA", "content": "", "creation_timestamp": "2026-09-27T11:00:15.000000Z"}, {"uuid": "a0eb79f4-2393-431f-b806-723a921f39ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "content": "", "creation_timestamp": "2026-09-27T21:00:04.000000Z"}, {"uuid": "1811fd7a-28ea-4056-81a8-da23d0c73b24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "Telegram/Xs5RSNf8dUoer362h3C47eE9d4XRs66xIhTCunAO4l08ziA", "content": "", "creation_timestamp": "2026-09-27T11:00:15.000000Z"}, {"uuid": "1fe32995-b7f6-4a57-89bb-772faa1a7ba5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "https://t.me/GithubRedTeam/103899", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #Remote Code Execution\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MRdark-ops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-30 18:29:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-30T19:07:32.000000Z"}, {"uuid": "87afaddb-a5c9-4dd4-a136-ff546319d87c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103899", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #Remote Code Execution\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-12227\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MRdark-ops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-30 18:29:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-30T19:07:32.000000Z"}, {"uuid": "168983bd-6d1c-4843-a146-03fbc5aff04c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/FJhHNxuddf7TpLw0kSRARdOIBivVItQHKCcKtq2qfHsVogM", "content": "", "creation_timestamp": "2026-10-01T03:00:06.000000Z"}, {"uuid": "6f2b2d45-549d-40e8-8dd1-236d14462615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "seen", "source": "Telegram/p8fCe73qPhNi0gtkgFiWePACon_RGM1KmaCzYKDKoMfuYzQ", "content": "", "creation_timestamp": "2026-09-30T23:00:22.000000Z"}, {"uuid": "475ceb51-a938-446a-b527-66c31877a1ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12227", "type": "published-proof-of-concept", "source": "Telegram/p8fCe73qPhNi0gtkgFiWePACon_RGM1KmaCzYKDKoMfuYzQ", "content": "", "creation_timestamp": "2026-09-30T23:00:22.000000Z"}]}