Team Builder For WPBakery Page Builder Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the Team Builder For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress, affecting all versions through 1.0. The vulnerability arises in the 'team-builder-vc' shortcode, allowing authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server. This exploitation can be used to bypass access controls, access sensitive data, or execute code by including files that contain PHP code, especially in scenarios where 'safe' file types like images can be uploaded and included.

Impact

Exploitation of this vulnerability could lead to unauthorized file inclusion, allowing attackers to execute arbitrary PHP code on the server. This could be used to bypass access controls, access sensitive information, or execute malicious code.