Local File Inclusion Vulnerability in Page Builder by SiteOrigin for WordPress

CVE-2026-2448

What is CVE-2026-2448?

The Page Builder by SiteOrigin plugin for WordPress is susceptible to a Local File Inclusion vulnerability due to a flaw in the locate_template() function. This issue allows authenticated users with Contributor-level access and above to include and execute arbitrary files on the server. Attackers could potentially exploit this vulnerability to bypass access controls, retrieve sensitive information, or execute PHP code from files that may appear safe, thereby jeopardizing the security and integrity of the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References