{
 "id": "WPSEC-2026-1345",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1345/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1345/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1345/index.md",
 "title": "Page Builder by SiteOrigin <= 2.37.0 - Authenticated (Contributor+) Sensitive Information Exposure via Post Loop Widget",
 "description": "The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Sensitive Information Exposure via the Post Loop widget in all versions up to, and including, 2.37.0. This is due to the widget running a query built from stored widget settings, which can include non-public post statuses, and rendering every resulting post without checking whether the viewer is allowed to read it. This makes it possible for authenticated attackers with contributor-level access and above, who can edit a layout, to display the content of other users' draft, pending, or private posts. Those posts are shown to themselves through a preview, or to visitors of a published page.",
 "plugin": {
  "slug": "siteorigin-panels",
  "name": "Page Builder by SiteOrigin",
  "full_name": "Page Builder by SiteOrigin",
  "wordpress_org": "https://wordpress.org/plugins/siteorigin-panels/",
  "advisories_url": "https://wpsec.com/vuln/plugin/siteorigin-panels/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/siteorigin-panels"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.38.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.38.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.38.0",
 "remediation": "Update to 2.38.0 or later.",
 "fix_released": "2026-10-19T22:18:30+00:00",
 "published": "2026-10-21T12:44:50+00:00",
 "updated": "2026-10-21T12:33:14.243380+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1345/",
  "https://plugins.svn.wordpress.org/siteorigin-panels/tags/2.38.0/",
  "https://wordpress.org/plugins/siteorigin-panels/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/siteorigin-panels",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-21"
 }
}