Page Builder by SiteOrigin <= 2.37.0 - Authenticated (Contributor+) Sensitive Information Exposure via Post Loop Widget
- ID
- WPSEC-2026-1345
- Plugin
- Page Builder by SiteOrigin (siteorigin-panels)
- Affected
- all versions before 2.38.0
- Remediation
- Update to 2.38.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-21
- Attack surface
- Page Builder by SiteOrigin on WPSec AttackSurface
- Fix released
- Published
Description
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Sensitive Information Exposure via the Post Loop widget in all versions up to, and including, 2.37.0. This is due to the widget running a query built from stored widget settings, which can include non-public post statuses, and rendering every resulting post without checking whether the viewer is allowed to read it. This makes it possible for authenticated attackers with contributor-level access and above, who can edit a layout, to display the content of other users' draft, pending, or private posts. Those posts are shown to themselves through a preview, or to visitors of a published page.
References
- https://wpsec.com/vuln/WPSEC-2026-1345/
- https://plugins.svn.wordpress.org/siteorigin-panels/tags/2.38.0/
- https://wordpress.org/plugins/siteorigin-panels/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS