CVE-2023-0159 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Product**: WordPress Plugin: 'Extensive VC Addons for WPBakery page builder'. 📉 **Affected Versions**: All versions **< 1.9.1**. 🌐 **Platform**: WordPress sites using this specific addon.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. Exploitation is **Unauthenticated**. Any visitor can trigger the vulnerability without credentials. High ease of use.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**. ✅ **Solution**: Upgrade the plugin to version **1.9.1** or later. The vendor has released a patch for this specific vulnerability.

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **HIGH**. ⚠️ **Reason**: Unauthenticated + Public PoCs + RCE potential. Immediate patching or deactivation is critical to prevent server compromise.

Updated May 06, 2026

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Path Traversal (LFI) in 'Extensive VC Addons for WPBakery'.
💥 **Consequences**: Attackers can read arbitrary files from the host server.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Lack of input validation on parameters passed to the `php extract` function during template loading.
🔍 **CWE**: Implicitly CWE-22 (Path Traversal) & CWE-913 (Improper Control of Filename for Include).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Product**: WordPress Plugin: 'Extensive VC Addons for WPBakery page builder'.
📉 **Affected Versions**: All versions **< 1.9.1**.
🌐 **Platform**: WordPress sites using this specific addon.

Q4What can hackers do? (Privileges/Data)

🕵️ **Privileges**: **Unauthenticated** access required. No login needed.
📂 **Data Impact**: Can read sensitive system files (e.g., `/etc/passwd`, config files).…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. Exploitation is **Unauthenticated**. Any visitor can trigger the vulnerability without credentials. High ease of use.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Public Exploits**: **YES**.
🛠️ **Tools**: 
- `EVCer` (Automatic Mass Tool using GNU Parallel).
- `nuclei-templates` (ProjectDiscovery).
- `Extensive` scanner.
🌍 **Status**: Active mass scanning and exploitation tools…

Read full answer (login)

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: 
Use **Nuclei** with the CVE-2023-0159 template.
Run **EVCer** script for bulk checking.
…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**.
✅ **Solution**: Upgrade the plugin to version **1.9.1** or later. The vendor has released a patch for this specific vulnerability.

Q9What if no patch? (Workaround)

🚧 **Workaround (If no patch)**:
1. **Disable/Deactivate** the 'Extensive VC Addons for WPBakery' plugin immediately.
2.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **HIGH**.
⚠️ **Reason**: Unauthenticated + Public PoCs + RCE potential. Immediate patching or deactivation is critical to prevent server compromise.

Continue exploring

Vulnerability detail Full AI analysis (login) Unknown