CVE-2023-5235 is a high severity (CVSS 8.8) flaw in the Ovic Responsive WPBakery WordPress plugin before version 1.2.9. Subscribers can update blog options through AJAX actions, and user input is unserialized in the process. Update the plugin to 1.2.9 or later.
What's affected
The NVD record says the plugin, before 1.2.9, does not limit which options can be updated through some of its AJAX actions. Attackers with a subscriber or higher account may update blog options such as users_can_register and default_role. It also unserializes user input in the process, which may lead to object injection attacks.
WPScan lists the fix as 1.2.9 and the plugin slug as ovic-vc-addon. Its CVSS score of 8.8 matches the NVD score. WPScan classes the entry as an option update issue.
The danger of a flaw that can change site options is that the effect is often permanent. If the default role is changed, every new registration can become a higher privilege account, and that remains true after the plugin is patched.
How to check if you're exposed
List plugin versions with WP-CLI.
wp plugin list --format=table
wp plugin get ovic-vc-addon --fields=name,status,version
Then check the two options named in the record on every site. Anyone can verify them from the shell.
wp option get users_can_register
wp option get default_role
If registration is open and the default role is anything above subscriber, review recent accounts at once.
What to do now
- Update Ovic Responsive WPBakery to 1.2.9 or later.
- Check that users_can_register and default_role hold the values you expect.
- Review users created since the plugin was installed, and remove those you cannot explain.
- Look for other options that might have changed, such as the admin email and site URL.
- Close open registration if you do not need it.
Why it matters
The record maps this to CWE-502, deserialization of untrusted data. Two problems combine here: an AJAX action that does not check what it is allowed to update, and a step that unserializes input from the request.
Unserializing user input can turn into object injection when classes with side effects are loaded. Whether it leads further depends on the code on the site. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. Treat settings changes as potentially persistent, and check them after you patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is patching enough?
Patch first, then check the site options. If an option such as the default role was changed before the update, the update does not reverse it.
Sources
Last reviewed: 19 October 2026.
