CVE-2024-13592
Published: 19 February 2025
Summary
CVE-2024-13592 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Webdevocean Team-Builder-For-Wpbakery-Page-Builder. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13592 is a Local File Inclusion vulnerability affecting the Team Builder For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress in all versions up to and including 1.0. The flaw exists in the 'team-builder-vc' shortcode, which enables the inclusion and execution of arbitrary files on the server. It is classified under CWE-98 with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to include arbitrary files, leading to the execution of PHP code within those files. Potential impacts include bypassing access controls, obtaining sensitive data, or achieving code execution, particularly when attackers upload "safe" file types like images that contain exploitable PHP payloads.
Advisories and additional details are available from Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7e8d76-a461-4b0b-a312-c6ea4b8ac375?source=cve and the plugin source code at https://plugins.trac.wordpress.org/browser/team-builder-for-wpbakery-page-builder/tags/1.0/plugin.class.php#L55.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4737
Vulnerability details
The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'team-builder-vc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access…
more
and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress plugin directly enables remote exploitation for arbitrary file inclusion and PHP code execution (RCE).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of shortcode parameters like those in 'team-builder-vc' to block arbitrary file paths and prevent local file inclusion.
SI-2 requires timely flaw remediation, such as patching or removing the vulnerable Team Builder plugin to eliminate the LFI vulnerability.
AC-6 enforces least privilege, restricting user roles below Contributor level from accessing exploitable shortcodes and reducing the attack surface.