All in One Addons for WPBakery Page Builder Local File Inclusion

Executive Summary

This vulnerability is a Local File Inclusion (LFI) flaw in the All in One Addons For WPBakery Page Builder WordPress plugin version 1.2 or below. It occurs because the plugin does not properly validate a shortcode attribute named 'vca_tabs_style' before using it to construct a file path. Attackers with contributor-level access or higher can exploit this to include and execute arbitrary local PHP files on the server.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the WordPress plugin 'All in One Visual Composer Addons' version 1.2 or below is installed. Review server logs for suspicious file inclusion attempts or unauthorized PHP file executions. Look for shortcode usage with the 'vca_tabs_style' attribute in WordPress posts or pages.

Useful 0 Not Useful 0

Impact Analysis

If you are using the vulnerable plugin version, an attacker with minimal access could execute malicious PHP code on your server. This could lead to complete server compromise, data theft, or further attacks against your WordPress site or connected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. It may result in unauthorized exposure of sensitive user data, triggering legal penalties, fines, or mandatory breach notifications depending on the regulation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the 'All in One Visual Composer Addons' plugin to the latest version if available. If no update exists, consider disabling or uninstalling the plugin until a patch is released. Restrict user roles to the minimum required permissions, especially contributor-level users.

Useful 0 Not Useful 0