Local File Inclusion in SiteOrigin Widgets Bundle Plugin for WordPress

CVE-2026-92174

What is CVE-2026-92174?

The SiteOrigin Widgets Bundle plugin for WordPress is susceptible to a Local File Inclusion vulnerability. This issue affects all versions up to and including 1.73.2 and allows authenticated attackers with contributor-level access to manipulate the 'theme' parameter. By crafting a malicious 'widgetData' payload that includes a legacy top-level theme key and a non-empty columns array, attackers can exploit the /wp-json/sowb/v1/widgets/previews REST endpoint. This exploitation bypasses field validation due to the update_fields() function's limitations, enabling the inclusion and execution of arbitrary .php files on the server. As a result, attackers can potentially execute PHP code, circumvent access controls, and access sensitive information.

References