CVE-2026-97256 in Page Builder by SiteOrigin Plugin
Summary
by MITRE • 09/30/2026
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as Editor PHP Object Injection within the Page Builder plugin for WordPress, specifically affecting versions up to and including 2.36.0, represents a critical security flaw that allows attackers to execute arbitrary code on the target server through serialized object manipulation. This type of attack leverages the inherent behavior of PHP's unserialize function when processing untrusted input without proper validation or sanitization. In this specific context, the vulnerability resides in how the plugin handles data submitted via its editor interface, where an attacker can inject a maliciously crafted serialized string that, upon deserialization by the application, triggers unintended side effects such as arbitrary file inclusion, remote code execution, or privilege escalation depending on which classes are available within the WordPress environment.
From a technical perspective, this flaw is categorized under CWE-502, which denotes Deserialization of Untrusted Data. The root cause typically involves the acceptance of user-controlled input that directly influences the structure of objects being instantiated by the application's internal logic. When the Page Builder processes these inputs to render page layouts or save widget configurations, it fails to restrict the types of classes that can be deserialized. This lack of strict type checking allows an attacker to construct a payload containing references to vulnerable PHP classes within the WordPress core or other installed plugins. By carefully crafting this serialized data, the attacker can invoke magic methods such as __wakeup(), __destruct(), or __toString() associated with these classes, leading to the execution of arbitrary system commands or access to sensitive internal states that were not intended for public interaction.
The operational impact of this vulnerability is severe, potentially resulting in a complete compromise of the affected WordPress installation and any underlying infrastructure hosting it. Successful exploitation enables an attacker to gain unauthorized administrative control over the website, allowing them to deface content, steal user data including credentials stored within the database, or install persistent backdoors for future access. Furthermore, because many web applications are interconnected through shared databases or common authentication mechanisms, a compromised WordPress site can serve as a pivot point for lateral movement into other parts of an organization's network. This aligns with several techniques in the MITRE ATT&CK framework, particularly T1059 Command and Scripting Interpreter for executing system commands via PHP functions like exec() or shell_exec(), and potentially T1136 Create Account if the attacker creates new administrator users to maintain persistence.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary and most effective solution is to upgrade the Page Builder plugin to a version greater than 2.36.0, where developers have presumably implemented stricter input validation or removed the vulnerable code paths entirely. For organizations unable to patch immediately due to compatibility constraints, temporary mitigations include restricting file upload permissions for untrusted users, disabling PHP execution in directories containing uploaded assets if possible, and implementing a Web Application Firewall (WAF) rule set designed to detect patterns associated with serialized object injection payloads. Additionally, developers should adopt secure coding practices such as using whitelisting approaches for allowed classes during deserialization or replacing the use of unserialize() with safer alternatives like JSON decoding where applicable, thereby eliminating the attack surface entirely by removing the mechanism that allows arbitrary class instantiation from untrusted input sources.