PT-2025-51077 · Unknown+1 · Wpbakery Page Builder+1

Naoya Takahashi · Published 2025-12-13 · Updated 2025-12-18 · CVE-2025-14475

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Extensive VC Addons for WPBakery page builder plugin for WordPress versions prior to 1.9.2

Description The software is susceptible to a Local File Inclusion issue due to insufficient path normalization and validation of the shortcode name parameter within the extensive vc init shortcode pagination AJAX action and the extensive vc get module template part function. This allows unauthenticated attackers to include and execute arbitrary PHP files on the server, potentially enabling the execution of any PHP code within those files.

Recommendations Update Extensive VC Addons for WPBakery page builder plugin for WordPress to version 1.9.2 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-14475

Affected Products

Extensive Vc Addons For Wpbakery Page Builder

Wpbakery Page Builder

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-14475 · Security Note
• https://twitter.com/RedPacketSec/status/1999948258089501018 · Twitter Post
• https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.php#L122 · Note
• https://twitter.com/CVEnew/status/1999865365774717303 · Twitter Post
• https://twitter.com/cracbot/status/2001608434060603868 · Twitter Post
• https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/lib/helpers-functions.php#L78 · Note
• https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L122 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/49711408-5d04-4fdd-a6c4-b224959ba1bc?source=cve · Note
• https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/lib/helpers-functions.php#L78 · Note
• https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L142 · Note
• https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.php#L142 · Note