SiteOrigin Widgets Bundle <= 1.75.0 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection in Widget Style Settings
- ID
- WPSEC-2026-2180
- Plugin
- SiteOrigin Widgets Bundle (so-widgets-bundle)
- Affected
- all versions before 1.76.0
- Remediation
- Update to 1.76.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-74
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- SiteOrigin Widgets Bundle on WPSec AttackSurface
- Fix released
- Published
Description
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to LESS Injection leading to Arbitrary File Read via widget style settings, such as those supplied in the [siteorigin_widget] shortcode's JSON instance, in all versions up to, and including, 1.75.0. This is due to an incomplete check on setting values written into the widget's LESS source. Values containing line breaks and comments were accepted, so a value could put an @import line of its own into the stylesheet, where the plugin moves it outside the widget ruleset. Inserted values were also searched again for other variables' declarations, and the complete stylesheet was not checked before it was compiled. This makes it possible for authenticated attackers, with contributor-level access and above, to make the LESS compiler include local files, such as wp-config.php, and expose their contents in the generated CSS.
References
- https://wpsec.com/vuln/WPSEC-2026-2180/
- https://plugins.svn.wordpress.org/so-widgets-bundle/tags/1.76.0/
- https://wordpress.org/plugins/so-widgets-bundle/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS