CVE-2026-97256: WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

Q: Who can exploit this vulnerability?

An attacker needs high-level privileges, as indicated by the PR:H vector. The issue is remotely exploitable and does not require user interaction.

Q: What impact could successful exploitation have?

The vulnerability is rated high severity with high confidentiality, integrity, and availability impact. Successful exploitation could affect data confidentiality, modify data, and disrupt service availability.

Q: Which plugin versions are affected?

SiteOrigin Page Builder by SiteOrigin versions 2.36.0 and earlier are affected.

Published Sep 30, 2026

Updated

Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

Affected Software

1 affected component

SiteOrigin Page Builder by SiteOrigin<=2.36.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Page Builder by SiteOrigin to a version that resolves this vulnerability.
Fixed in 2.36.1

Event History

Sep 30, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs high-level privileges, as indicated by the PR:H vector. The issue is remotely exploitable and does not require user interaction.

What impact could successful exploitation have?

The vulnerability is rated high severity with high confidentiality, integrity, and availability impact. Successful exploitation could affect data confidentiality, modify data, and disrupt service availability.

Which plugin versions are affected?

SiteOrigin Page Builder by SiteOrigin versions 2.36.0 and earlier are affected.

CVE-2026-97256: WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What impact could successful exploitation have?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What impact could successful exploitation have?

Which plugin versions are affected?