CVE-2026-110507: Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments

Q: Which users can exploit this issue?

Users with the Contributor role or any higher-privileged role can exploit it. The issue is relevant where such users can configure the Post Loop widget.

Q: What information could be disclosed?

An attacker could read content from other users' draft, pending, scheduled, and private posts and pages. The disclosure occurs by supplying query arguments to the Post Loop widget.

Q: Are standard content visibility controls sufficient to prevent disclosure?

No. The affected versions do not limit Post Loop results to posts that the widget user is authorized to read, so non-public content belonging to other users may be exposed.

Q: What version resolves the issue?

Upgrade Page Builder by SiteOrigin to version 2.38.0 or later. Versions before 2.38.0 are affected.

Published Oct 28, 2026

Updated

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.

Affected Software

1 affected component

SiteOrigin Page Builder by SiteOrigin<2.38.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Page Builder by SiteOrigin to a version that resolves this vulnerability.
Fixed in 2.38.0

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Users with the Contributor role or any higher-privileged role can exploit it. The issue is relevant where such users can configure the Post Loop widget.

What information could be disclosed?

An attacker could read content from other users' draft, pending, scheduled, and private posts and pages. The disclosure occurs by supplying query arguments to the Post Loop widget.

Are standard content visibility controls sufficient to prevent disclosure?

No. The affected versions do not limit Post Loop results to posts that the widget user is authorized to read, so non-public content belonging to other users may be exposed.

What version resolves the issue?

Upgrade Page Builder by SiteOrigin to version 2.38.0 or later. Versions before 2.38.0 are affected.

CVE-2026-110507: Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What information could be disclosed?

Are standard content visibility controls sufficient to prevent disclosure?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What information could be disclosed?

Are standard content visibility controls sufficient to prevent disclosure?

What version resolves the issue?