CVE-2026-92174

HighCVSS 7.5

Published: 02/10/2026(UTC)Updated: 03/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

45th percentile - higher than 45% of all known CVEs

Summary

The SiteOrigin Widgets Bundle plugin for WordPress (versions up to and including 1.73.2) is vulnerable to Local File Inclusion via the 'theme' parameter. An authenticated attacker with contributor-level access or higher can include and execute arbitrary .php files on the server, leading to PHP code execution. Exploitation requires sending a malicious widgetData payload with a legacy top-level theme key to the /wp-json/sowb/v1/widgets/previews REST endpoint.

Risk Assessment

An attacker with a contributor account can execute arbitrary PHP code on the server, bypass access controls, obtain sensitive data, or fully compromise the site. The risk is high because the required privileges are low and easily obtained in many WordPress installations.

Recommendation

Update the SiteOrigin Widgets Bundle plugin to a version later than 1.73.2 that fixes this vulnerability. Until then, restrict contributor account registration and monitor for unusual requests to the /wp-json/sowb/v1/widgets/previews endpoint.

Other vulnerabilities in SiteOrigin Widgets Bundle

CVE-2026-97348Medium
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.74.3 via the get_instance_css function. This allows authenticated attackers with contributor-level access and above to read the contents of arbitrary files on the server, which may contain sensitive information. The normal update()/sanitize_field_input() pipeline is bypassed entirely because the shortcode handler calls $the_widget->widget() directly on the attacker-supplied decoded JSON instance.

Original NVD description (English source)

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because update_fields() only processes declared form fields.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS