WordPress - Visual Composer Website Builder - CRITICAL - CVE-2026-12227. The Visual Composer Website Builder plugin for WordPress allows local file inclusion through the `vcv-template` parameter in all versions up to and including 45.16.0. This vulnerability enables unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to unauthorized access to sensitive information, execution of harmful PHP code, and bypassing of access controls. Attackers can exploit this flaw by uploading malicious scripts disguised as harmless files, putting WordPress sites at significant risk.