CVE-2023-0159: Extensive VC Addons for WPBakery WordPress plugin arbitrary file read via extract()

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated network-accessible arbitrary file read with potential RCE escalation and a high EPSS score, though no KEV listing.

What it is

The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 passes an unvalidated parameter to PHP's extract() function when loading templates. An unauthenticated attacker can override the template path and read arbitrary files from the host filesystem. The flaw may be escalated to remote code execution using PHP filter chains.

Impact

An attacker gains read access to arbitrary files on the server, which can expose configuration secrets and credentials. With PHP filter chains, this can potentially be escalated to remote code execution.

Attack surface

Reachable over the network through the WordPress plugin's template loading functionality, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.55459 (99th percentile) and both references are tagged Exploit, indicating public exploit code exists.

What to do

• Update the Extensive VC Addons for WPBakery page builder plugin to version 1.9.1 or later.
• If patching is not immediately possible, disable or remove the plugin until it can be updated.
• Restrict file permissions and harden PHP configuration to limit the impact of arbitrary file reads.
• Monitor for and block requests attempting path traversal or PHP filter chain payloads against the plugin.

Detection

• Review web server logs for requests to the plugin's template loading endpoints containing path traversal or php://filter strings.
• Alert on unexpected access to sensitive files such as /etc/passwd or wp-config.php from the web process.
• Monitor for PHP filter chain patterns in request parameters targeting the plugin.
• Use file integrity monitoring to detect unauthorized file reads or changes on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.