# SiteOrigin Widgets Bundle <= 1.75.0 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection in Widget Style Settings

- **ID:** WPSEC-2026-2180
- **Plugin:** SiteOrigin Widgets Bundle (`so-widgets-bundle`), https://wordpress.org/plugins/so-widgets-bundle/
- **Affected versions:** all versions before 1.76.0
- **Fixed in:** 1.76.0 (Update to 1.76.0 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/so-widgets-bundle
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2180/

## Description

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to LESS Injection leading to Arbitrary File Read via widget style settings, such as those supplied in the [siteorigin_widget] shortcode's JSON instance, in all versions up to, and including, 1.75.0. This is due to an incomplete check on setting values written into the widget's LESS source. Values containing line breaks and comments were accepted, so a value could put an @import line of its own into the stylesheet, where the plugin moves it outside the widget ruleset. Inserted values were also searched again for other variables' declarations, and the complete stylesheet was not checked before it was compiled. This makes it possible for authenticated attackers, with contributor-level access and above, to make the LESS compiler include local files, such as wp-config.php, and expose their contents in the generated CSS.

## References

- https://wpsec.com/vuln/WPSEC-2026-2180/
- https://plugins.svn.wordpress.org/so-widgets-bundle/tags/1.76.0/
- https://wordpress.org/plugins/so-widgets-bundle/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2180/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.