CVE-2023-6925 is a high severity (CVSS 7.2) arbitrary file upload flaw in the Unlimited Addons for WPBakery Page Builder plugin for WordPress, versions up to and including 1.0.42. Editors can upload files that may lead to code execution. Update beyond 1.0.42 or remove the plugin.
What's affected
The record says versions up to and including 1.0.42 are affected. The flaw is in the importZipFile function and needs an account with a role the administrator previously granted access to the plugin. The default is the editor role, and access can also be given to contributors.
The referenced Wordfence entry and plugin source pages did not load for automated reading, so the fixed version is not stated here. Any release above 1.0.42 is the starting point, and the changelog will confirm the fix.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get unlimited-addons-for-wpbakery-page-builder --field=version
Versions up to and including 1.0.42 are affected. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
What to do now
- Update the plugin:
wp plugin update unlimited-addons-for-wpbakery-page-builder, or use the Plugins screen. Confirm the version is above 1.0.42. - If no fixed release is available, deactivate and delete the plugin and use a maintained alternative.
- Review the site's user list and recent changes for anything you do not recognize, and rotate credentials the plugin handled.
- Keep automatic updates on for plugins that handle sensitive data, and remove plugins you no longer use.
- Review which roles can use the plugin and remove access you do not need.
Why it matters
The record says the importZipFile function does not validate file types well enough. A user with plugin access can place arbitrary files on the server, and the record notes this may make remote code execution possible. It tags CWE-434.
Unrestricted file upload turns a file feature into a code delivery path. When a server stores a file in a web-reachable folder and does not check what kind of file it is, a script that the web server will run can end up where it can be requested. Allow lists of file types, renaming on save, and storing uploads outside the web root are the standard defenses.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-434 (Unrestricted File Upload).
Quick check
Is an editor account really a risk?
Editors are trusted with content, not with server access. A plugin that lets that role place arbitrary files crosses that line.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
