CVE-2026-28038 PUBLISHED

WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerability

Assigner: Patchstack
Reserved: 25.02.2026 Published: 05.03.2026 Updated: 05.03.2026

Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through <= 3.21.1.

Product Status

Vendor	Brainstorm_Force
Product	Ultimate Addons for WPBakery Page Builder
Versions	Default: unaffected affected from n/a to <= 3.21.1 (incl.)

Credits

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program finder

References

https://patchstack.com/database/Wordpress/Plugin/ultimate_vc_addons/vulnerability/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-21-1-broken-access-control-vulnerability?_s_id=cve

Problem Types

Missing Authorization CWE

Impacts

Exploiting Incorrectly Configured Access Control Security Levels