CVE-2026-92174

Summary

The SiteOrigin Widgets Bundle plugin has a local file inclusion vulnerability that allows authenticated users with contributor level access or higher to execute arbitrary PHP code on the server by manipulating widget data through a REST endpoint. This can lead to complete compromise of the WordPress site.

Exploitability

Exploitation requires an authenticated user with contributor privileges who can send a specific widgetData payload to the /wp-json/sowb/v1/widgets/previews endpoint, making it moderately difficult but achievable in environments where contributors have access.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the server, potentially leading to full site compromise, data exfiltration, or use as a foothold for further attacks within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.73.3 or later which contains the fix for the LFI vulnerability in the SiteOrigin Widgets Bundle plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.