Description
WordPress Plugin Visual Composer:Page Builder for WordPress is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Visual Composer:Page Builder for WordPress version 5.1 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 5.1.1 or latest
References
http://wphutte.com/visual-composer-v5-1-local-php-file-include/
https://codecanyon.net/item/visual-composer-page-builder-for-wordpress/242431
Related Vulnerabilities
OpenSSL Improper Input Validation Vulnerability (CVE-2010-0433)
PHP Other Vulnerability (CVE-2002-0717)
Python Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2019-9947)
WordPress Plugin Scoutnet Kalender Cross-Site Scripting (1.1.0)
WordPress Plugin WP-VR-view-Add Photo Sphere, 360 video to WordPress Cross-Site Scripting (1.6)