CVE-2023-0159

What it actually does

CVE-2023-0159 is an unauthenticated arbitrary file read vulnerability in the Extensive VC Addons for WPBakery Page Builder WordPress plugin before version 1.9.1. The plugin fails to validate user-controlled input used when loading templates and passes that data into PHP variable extraction logic, allowing an attacker to override the template path. As a result, a remote attacker can cause the application to read files from the underlying web server filesystem, including sensitive WordPress configuration files. In some configurations, this class of file-read primitive may be escalated to remote code execution through PHP filter-chain techniques, especially where PHP stream wrappers and vulnerable code paths are reachable.

Why it matters to the business

Successful exploitation can expose sensitive files such as WordPress configuration data, database credentials, authentication salts, source code, backups, and other locally readable secrets. This can lead to website takeover, credential reuse against databases or hosting control panels, data theft, defacement, malware injection, SEO spam, or staging for broader compromise of the hosting environment. The vulnerability is weaponized and has a high EPSS score of 0.55736, meaning exploitation in the wild or opportunistic scanning is plausible even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker identifies a WordPress site using a vulnerable version of the Extensive VC Addons for WPBakery plugin. Without needing authentication, the attacker sends crafted HTTP requests to the plugin’s template-loading functionality and manipulates the parameter that influences the template path. Because the plugin does not properly constrain the resolved path to an approved template directory, the attacker can traverse or override the path to access arbitrary local files such as wp-config.php, server configuration files, logs, or application source. The attacker then uses exposed secrets, such as database credentials or WordPress salts, to expand access. In more advanced exploitation, the attacker may attempt PHP stream-wrapper or filter-chain payloads to transform the file-read issue into code execution, enabling webshell deployment, persistent administrator access, or malware installation.

How to fix it

Upgrade the Extensive VC Addons for WPBakery Page Builder plugin to version 1.9.1 or later. If a fixed version is unavailable through normal update channels, disable and remove the plugin until a trusted patched release can be installed. Restrict direct access to WordPress administrative and AJAX endpoints where feasible using WAF rules, authentication controls, IP allowlists, or rate limiting, but do not treat these as a substitute for patching. Review filesystem permissions so the web server user cannot read unnecessary sensitive files outside the WordPress application directory. Rotate any credentials or secrets that may have been exposed, especially database passwords, WordPress authentication salts, API keys, and hosting credentials. If compromise is suspected, perform full incident response before re-enabling the plugin.

How to confirm the fix worked

Verify the installed plugin version is 1.9.1 or later by checking the WordPress plugin inventory, the plugin’s readme or metadata, and the filesystem copy under wp-content/plugins. Confirm no vulnerable copy remains in inactive plugin directories, backups, staging paths, or alternate WordPress installations on the same host. Test that unauthenticated requests attempting path traversal, wp-config.php access, /etc/passwd access, or php://filter payloads are blocked or return only normal application errors. Review WAF and web server logs to confirm exploit attempts are denied after remediation. Where possible, validate with an authenticated administrative plugin inventory scan and an unauthenticated external exposure scan.

Typical attack path

1. Scan public WordPress sites for the Extensive VC Addons for WPBakery plugin or plugin-specific assets.
2. Confirm the plugin appears to be a vulnerable pre-1.9.1 version.
3. Send unauthenticated crafted requests to the plugin’s template-loading endpoint or AJAX handler.
4. Manipulate the template path parameter using traversal sequences or PHP stream-wrapper syntax.
5. Read sensitive local files such as wp-config.php, web server logs, backups, or source files.
6. Extract database credentials, salts, API keys, or other secrets from readable files.
7. Use exposed credentials or chained PHP filter techniques to escalate from file disclosure to site takeover or remote code execution.
8. Install persistence such as a malicious plugin, theme modification, webshell, injected administrator account, or malicious scheduled task.

How to detect it

Investigate web server access logs, WAF/CDN logs, reverse proxy logs, WordPress debug logs, PHP-FPM logs, and endpoint/file integrity telemetry for evidence of unauthenticated requests attempting to manipulate plugin template-loading behavior. Focus on requests to WordPress AJAX endpoints or the Extensive VC Addons plugin directory that include path traversal strings, encoded traversal, attempts to access wp-config.php, /etc/passwd, server logs, or PHP stream wrappers such as php://filter. Look for repeated 200 responses with unusual response sizes following suspicious parameters, as this may indicate successful file disclosure. Review for follow-on activity after suspected file reads, including WordPress administrator logins from unusual IPs, new admin users, plugin/theme editor changes, modified PHP files, new files under wp-content/uploads, suspicious POST requests to newly created PHP files, and outbound callbacks from the web server. Because exploitation can expose credentials, also review database authentication logs, hosting panel logs, and application login history around the time of suspicious requests.

• wp-admin/admin-ajax.php
• wp-content/plugins/extensive-vc-addons
• wp-content/plugins/extensive-vc-addons-for-wpbakery
• ../wp-config.php
• ..%2fwp-config.php
• ..%252fwp-config.php
• /etc/passwd
• ..%2f..%2f..%2f..%2fetc%2fpasswd
• php://filter
• php%3A%2F%2Ffilter
• convert.base64-encode
• convert.iconv
• resource=wp-config.php
• resource%3Dwp-config.php
• php://temp
• php://memory
• data://text/plain
• expect://
• /wp-content/uploads/
• eval(
• base64_decode(
• gzinflate(
• shell_exec(
• system(
• passthru(
• assert(

What your security team should do

• Prioritize patching or removal because exploitation is weaponized and the EPSS score indicates elevated likelihood of real-world exploitation.
• Upgrade Extensive VC Addons for WPBakery Page Builder to version 1.9.1 or later across all WordPress installations.
• Search web server, WAF, CDN, and WordPress logs for historical requests containing traversal sequences, php://filter usage, or attempts to read wp-config.php and other local files.
• Assume secrets may be exposed if exploit attempts succeeded; rotate database credentials, WordPress salts, API keys, and hosting credentials as appropriate.
• Inspect WordPress for post-exploitation artifacts, including unexpected administrator accounts, modified theme/plugin files, suspicious uploads, malicious plugins, and webshells.
• Deploy WAF rules to block requests containing path traversal, PHP stream wrappers, and suspicious template-loading parameters targeting WordPress AJAX or plugin paths.
• Audit file permissions to limit what the web server process can read and write.
• Monitor for outbound connections, new PHP files in upload directories, and anomalous database or administrator activity following any suspected exploitation.