Visual Composer Website Builder Broken Access Control

Executive Summary

CVE-2026-65568 is a Broken Access Control vulnerability in the WordPress Visual Composer Website Builder Plugin affecting versions 45.15.0 and earlier. It allows unprivileged users like contributors or developers to perform actions that require higher privileges due to missing authorization, authentication, or nonce token checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of the Visual Composer Website Builder plugin. If it is version 45.15.0 or earlier, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin files for version details.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to modify or delete content, change settings, or perform other privileged actions without proper permissions. However, its CVSS score of 5 indicates low severity and a lower likelihood of exploitation in mass campaigns.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unprivileged users to perform actions requiring higher privileges due to missing authorization checks. While not directly impacting GDPR or HIPAA compliance, it could indirectly lead to unauthorized data access or modifications, which may violate these regulations if sensitive data is involved. Organizations should address this to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Visual Composer Website Builder Plugin to version 45.16.0 or later immediately. If updating is not possible, seek assistance from your hosting provider or web developer. Enable auto-updates for vulnerable plugins if using Patchstack.

Useful 0 Not Useful 0