The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'. It also unserializes user input in the process, which may lead to Object Injection attacks.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ovic Vc Addon Plugin | — | Update ovic-vc-addon plugin to version 1.2.9, or a newer patched version | May 15, 2025 | Nov 7, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub