so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion
CVE-2023-6295

7.2HIGH

Key Information:

Vendor
Wordpress
Status
SiteOrigin Widgets Bundle
Vendor
CVE Published:
18 December 2023

Summary

The SiteOrigin Widgets Bundle plugin for WordPress prior to version 1.51.0 contains a vulnerability due to inadequate validation of user input. This oversight permits users with administrator privileges on Multisite installations to exploit Local File Inclusion (LFI) attacks. Consequently, attackers may manipulate paths fed to the include functions, potentially leading to unauthorized access to sensitive files on the server.

Affected Version(s)

SiteOrigin Widgets Bundle 0 < 1.51.0

References

https://wpscan.com/vulnerability/adc9ed9f-55b4-43a9-a79d-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sebastian Neef
WPScan
.