What’s Vulnerable › Vulnerabilities

CVE-2021-24244: WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Update

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-06 · updated 2026-06-17
• Weakness: CWE-863

Description

An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).

Affected products

• bitorbit WPBakery Page Builder (Visual Composer) Clipboard: from 4.5.0 before 4.5.8 — fixed in 4.5.8

How to fix

Upgrade to a fixed version: bitorbit WPBakery Page Builder (Visual Composer) Clipboard 4.5.8. Check the vendor advisory for mitigations.

References

• https://codecanyon.net/item/visual-composer-clipboard/8897711
• https://wpscan.com/vulnerability/354b98d8-46a1-4189-b347-198701ea59b9
• https://codecanyon.net/item/visual-composer-clipboard/8897711
• https://wpscan.com/vulnerability/354b98d8-46a1-4189-b347-198701ea59b9

Get alerted when CVE-2021-24244 or the next vulnerability affects your stack