CVE-2023-0159: 
WordPress vulnerability analysis and mitigation

CVE-2023-0159 affects the Extensive VC Addons for WPBakery page builder WordPress plugin versions below 1.9.1. The vulnerability was discovered and reported by researcher dc11, with the escalation to RCE reported by Valentin Lobstein. The issue was publicly disclosed on January 25, 2023 (WPScan).

The vulnerability stems from improper parameter validation in the php extract function when loading templates. This security flaw allows an unauthenticated attacker to override the template path, enabling them to read arbitrary files from the host's file system. The vulnerability can be escalated to Remote Code Execution (RCE) using PHP filter chains. The vulnerability has been assigned a CVSS score of 10.0 (Critical), indicating the highest severity level (WPScan).

An unauthenticated attacker can exploit this vulnerability to read arbitrary files from the host's file system and potentially execute arbitrary code on the affected system. This level of access could lead to complete system compromise (WPScan).

The vulnerability is exploitable through the WordPress admin-ajax.php endpoint, requiring no authentication. A proof of concept exists demonstrating both Local File Inclusion (LFI) and Remote Code Execution capabilities using PHP filter chains (WPScan).

The vulnerability has been fixed in version 1.9.1 of the Extensive VC Addons for WPBakery page builder plugin. Users are strongly advised to update to this version or later to mitigate the risk (WPScan).