CVE-2026-110507 in Page Builder by SiteOrigin Plugin
Summary
by MITRE • 10/28/2026
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Page Builder by SiteOrigin prior to version 2.38.0 represents a critical failure in access control mechanisms within the WordPress ecosystem. This plugin serves as a visual drag-and-drop page builder, allowing users with varying levels of administrative privileges to construct complex layouts and content structures without requiring deep technical knowledge of HTML or CSS. The specific flaw resides within the Post Loop widget feature, which is designed to display dynamic lists of posts based on user-defined criteria such as category, tag, author, or date. While this functionality provides significant flexibility for website designers, it introduces a severe security risk when query arguments are not properly sanitized or validated against the current user's permissions.
The core technical flaw involves an improper restriction of input parameters passed to the WordPress Query API. When a user configures the Post Loop widget, they can specify various query arguments that determine which posts are retrieved and displayed on the frontend. In vulnerable versions, the plugin fails to enforce strict limitations on these inputs or verify whether the executing user has the requisite capabilities to access the requested data. Consequently, an attacker with at least the contributor role, which is typically assigned to content creators who do not have full administrative privileges, can manipulate these query parameters to bypass standard WordPress capability checks. This allows them to construct queries that retrieve posts marked as draft, pending review, scheduled for future publication, or explicitly set to private visibility.
The operational impact of this vulnerability extends beyond simple data leakage, potentially compromising the integrity and confidentiality of a website's content pipeline. By accessing unpublished drafts, an attacker can gain insight into upcoming marketing strategies, product launches, or editorial plans before they are made public. This information could be used for competitive intelligence or to time malicious attacks more effectively. Furthermore, the ability to view private posts reveals sensitive internal communications or restricted information intended only for specific user groups. The exposure of pending and scheduled content undermines the workflow integrity of collaborative teams relying on WordPress for structured content management, as it allows unauthorized parties to see work in progress that was never meant to be visible outside the editorial team.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures where a user can access resources or perform actions they are not authorized to do. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as it exploits legitimate but insufficiently privileged accounts to gain unauthorized information access. The attack vector is primarily local within the context of WordPress roles, meaning an attacker must have a valid account with at least contributor-level permissions on the targeted site. This distinguishes it from remote code execution vulnerabilities but places it firmly in the category of sensitive data exposure and privilege escalation through logic flaws rather than technical exploitation of memory or input parsing errors.
Mitigation strategies for this vulnerability involve immediate updates to the Page Builder by SiteOrigin plugin to version 2.38.0 or later, where these access control checks have been implemented. For organizations unable to update immediately due to compatibility concerns with other plugins or themes, temporary workarounds include restricting the contributor role's ability to use page builder features if possible through custom code snippets that disable specific widgets for lower-privileged users. Additionally, implementing a Web Application Firewall (WAF) can help detect and block anomalous query patterns associated with this exploitation attempt, although such measures are less reliable than patching the underlying application logic. Regular auditing of plugin permissions and adhering to the principle of least privilege by assigning only necessary capabilities to user roles remains essential for maintaining long-term security posture in WordPress environments.