CVE-2026-97256: WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability
Published Sep 30, 2026
·Updated
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
Affected Software
1 affected component
SiteOrigin Page Builder by SiteOrigin<=2.36.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Page Builder by SiteOriginto a version that resolves this vulnerability.Fixed in 2.36.1
Event History
Sep 30, 2026
CVE Published
via MITRE·05:39 PM
Data Sourced
via MITRE·05:39 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·06:18 PM
DescriptionSeverityWeakness
Dec 30, 58722
Event
via FIRST·05:04 PM
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker needs high-level privileges, as indicated by the PR:H vector. The issue is remotely exploitable and does not require user interaction.
2
What impact could successful exploitation have?
The vulnerability is rated high severity with high confidentiality, integrity, and availability impact. Successful exploitation could affect data confidentiality, modify data, and disrupt service availability.
3
Which plugin versions are affected?
SiteOrigin Page Builder by SiteOrigin versions 2.36.0 and earlier are affected.