CVE-2026-92174 in Widgets Bundle Plugin
Summary
by MITRE • 10/02/2026
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because update_fields() only processes declared form fields.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The SiteOrigin Widgets Bundle plugin for WordPress contains a critical Local File Inclusion vulnerability affecting all versions up to and including 1.73.2. This flaw resides within the handling of the theme parameter during widget preview operations, specifically targeting the REST API endpoint located at /wp-json/sowb/v1/widgets/previews. The root cause of this vulnerability is an insufficient validation mechanism in the update_fields() function, which processes only declared form fields while ignoring other parameters passed in the request payload. This architectural oversight allows attackers to inject arbitrary file paths through the theme parameter, bypassing standard input sanitization checks that would otherwise restrict such operations.
Exploitation of this vulnerability requires authenticated access with at least contributor-level privileges or higher. An attacker must construct a malicious widgetData payload containing two specific elements: a legacy top-level theme key and a non-empty columns array. By sending this crafted request to the specified REST endpoint, the application fails to properly validate the theme parameter before using it in file inclusion logic. Consequently, an authenticated user can cause the server to include and execute arbitrary PHP files located on the local filesystem or accessible via web paths. This capability effectively neutralizes access controls by allowing low-privileged users to escalate their influence over the system through code execution rather than standard administrative functions.
The operational impact of this vulnerability is severe, as it facilitates Remote Code Execution under specific conditions where attackers can upload and include PHP files. Once arbitrary PHP code is executed on the server, an attacker gains the ability to perform a wide range of malicious activities. These include bypassing existing access controls to elevate privileges, exfiltrating sensitive data such as database credentials or user information, and establishing persistent backdoors within the WordPress installation. The vulnerability essentially transforms a standard content management system into a fully compromised environment, granting attackers full control over the underlying server infrastructure depending on the permissions of the web server process.
From a classification perspective, this issue aligns with CWE-98 Improper Control of Filename for Include/Include Once in PHP Programs and falls under MITRE ATT&CK technique T1059 Command and Scripting Interpreter via local file inclusion patterns. To mitigate this risk, administrators should immediately update the SiteOrigin Widgets Bundle plugin to a version newer than 1.73.2 where the validation logic has been corrected to strictly enforce allowed values for the theme parameter. Additionally, implementing Web Application Firewalls with rules targeting suspicious REST API payloads can provide an additional layer of defense against exploitation attempts before patches are applied. Regular auditing of user permissions and restricting upload capabilities further reduces the attack surface associated with this vulnerability type.