CVE-2023-0159

Deeper analysis

The Extensive VC Addons for WPBakery page builder WordPress plugin before version 1.9.1 contains an input-validation flaw in its template-loading logic. A parameter supplied to PHP's extract function is not sanitized, allowing an attacker to override the intended template path and retrieve arbitrary files from the underlying filesystem. The issue carries a CVSS 3.1 score of 7.5 and is tracked as CVE-2023-0159.

An unauthenticated remote attacker can trigger the flaw simply by sending a crafted request to any affected site. Successful exploitation yields disclosure of sensitive local files; the advisory notes that the same primitive can be escalated to remote code execution through PHP filter-chain techniques.

The referenced WPScan advisory confirms the vulnerability exists in all releases prior to 1.9.1 and states that updating to version 1.9.1 or later eliminates the defective code path. The associated EPSS score remains elevated near 0.93 with no material change from a documented low baseline.