CVE-2026-92174
Received Received - Intake

Local File Inclusion in SiteOrigin Widgets Bundle WordPress Plugin

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Wordfence

Description
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because update_fields() only processes declared form fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-92174
EUVD
EUVD-2026-91178

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siteorigin widgets_bundle to 1.73.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Local File Inclusion (LFI) issue in the SiteOrigin Widgets Bundle WordPress plugin affecting versions up to 1.73.2. It allows authenticated attackers with contributor-level access or higher to include and execute arbitrary PHP files on the server by exploiting the 'theme' parameter. This can lead to code execution, data theft, or bypassing access controls.

Detection Guidance

Detecting this vulnerability requires checking for the SiteOrigin Widgets Bundle plugin versions up to 1.73.2. Use WordPress admin panel to verify plugin versions or run commands like 'wp plugin list' in WP-CLI. Inspect server logs for suspicious requests to /wp-json/sowb/v1/widgets/previews with malicious payloads containing 'theme' parameter.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious PHP code on your server, steal sensitive data, or bypass security measures. Attackers need contributor-level access or higher to exploit it, but successful exploitation could lead to full system compromise depending on server configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance requirements. Data breaches resulting from this flaw may result in legal penalties, reputational damage, and loss of trust due to non-compliance with data protection regulations.

Mitigation Strategies

Immediately update the SiteOrigin Widgets Bundle plugin to the latest version beyond 1.73.2. If updating is not possible, disable the plugin temporarily. Review server file permissions to restrict PHP file execution in upload directories. Monitor for unauthorized file inclusions or code execution attempts in server logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92174. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart