CVE-2026-92174: SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because updatefields() only processes declared form fields.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level access or higher. They must be able to send requests to the plugin's /wp-json/sowb/v1/widgets/previews REST endpoint.
What conditions are required for exploitation?
The attacker must submit a malicious widgetData payload containing a legacy top-level theme key and a non-empty columns array. Successful abuse also depends on PHP files being present on the server that can be included and executed; impact is especially severe where PHP files can be uploaded and then included.
How can defenders identify attempted exploitation?
Review requests to /wp-json/sowb/v1/widgets/previews for widgetData payloads that include a top-level theme key together with a non-empty columns array. Also investigate Contributor or higher accounts for unexpected activity and review server and WordPress logs for suspicious PHP file inclusion or execution.