CVE-2026-97348: SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The widget's normal update()/sanitizefieldinput() pipeline — which would reject non-hex color values — is bypassed entirely because the [siteoriginwidget] shortcode handler calls $thewidget->widget() directly on the attacker-supplied decoded JSON instance.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to WordPress with at least Contributor-level access. They also need to be able to submit a [siteorigin_widget] shortcode containing an attacker-controlled JSON instance.
What information could be exposed?
Successful exploitation allows reading arbitrary files from the server through directory traversal. Exposed files may contain sensitive information, depending on the web server's file permissions and accessible paths.
Does normal widget input validation prevent exploitation?
No. The shortcode handler passes the decoded attacker-supplied JSON instance directly to the widget rendering function, bypassing the normal update() and sanitize_field_input() validation pipeline that would reject non-hex color values.
How can I determine whether my site is affected?
Sites using SiteOrigin Widgets Bundle version 1.74.3 or earlier are affected. Review whether Contributor or higher roles are assigned to untrusted users and whether those users can submit or cause rendering of [siteorigin_widget] shortcodes.