CVE-2026-97348

MediumCVSS 6.5

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 10/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.73%

53th percentile - higher than 53% of all known CVEs

Summary

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.74.3 via the get_instance_css function. This allows authenticated attackers with contributor-level access and above to read the contents of arbitrary files on the server, which may contain sensitive information. The normal update()/sanitize_field_input() pipeline is bypassed entirely because the shortcode handler calls $the_widget->widget() directly on the attacker-supplied decoded JSON instance.

Risk Assessment

The organization may lose confidential data such as configuration files, credentials, or other sensitive information stored on the server. Attackers with low privileges can access data that should be protected.

Recommendation

Immediately update the SiteOrigin Widgets Bundle plugin to the latest available version that includes the fix. Also restrict access to low-privilege accounts and monitor logs for unusual requests.

Other vulnerabilities in SiteOrigin Widgets Bundle

CVE-2026-92174High
The SiteOrigin Widgets Bundle plugin for WordPress (versions up to and including 1.73.2) is vulnerable to Local File Inclusion via the 'theme' parameter. An authenticated attacker with contributor-level access or higher can include and execute arbitrary .php files on the server, leading to PHP code execution. Exploitation requires sending a malicious widgetData payload with a legacy top-level theme key to the /wp-json/sowb/v1/widgets/previews REST endpoint.

Original NVD description (English source)

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The widget's normal update()/sanitize_field_input() pipeline — which would reject non-hex color values — is bypassed entirely because the [siteorigin_widget] shortcode handler calls $the_widget->widget() directly on the attacker-supplied decoded JSON instance.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS