# Page Builder by SiteOrigin <= 2.37.0 - Authenticated (Contributor+) Sensitive Information Exposure via Post Loop Widget

- **ID:** WPSEC-2026-1345
- **Plugin:** Page Builder by SiteOrigin (`siteorigin-panels`), https://wordpress.org/plugins/siteorigin-panels/
- **Affected versions:** all versions before 2.38.0
- **Fixed in:** 2.38.0 (Update to 2.38.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/siteorigin-panels
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1345/

## Description

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Sensitive Information Exposure via the Post Loop widget in all versions up to, and including, 2.37.0. This is due to the widget running a query built from stored widget settings, which can include non-public post statuses, and rendering every resulting post without checking whether the viewer is allowed to read it. This makes it possible for authenticated attackers with contributor-level access and above, who can edit a layout, to display the content of other users' draft, pending, or private posts. Those posts are shown to themselves through a preview, or to visitors of a published page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1345/
- https://plugins.svn.wordpress.org/siteorigin-panels/tags/2.38.0/
- https://wordpress.org/plugins/siteorigin-panels/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1345/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.