CVE-2026-92174 gpriday CVE debrief

Who should care

Defenders responsible for WordPress installations with the SiteOrigin Widgets Bundle plugin, particularly those with contributor-level access enabled, should assess exposure and prioritize verification and remediation.

Why it matters

The SiteOrigin Widgets Bundle plugin vulnerability allows authenticated attackers to execute arbitrary PHP code, bypass access controls, and obtain sensitive data. Defenders should prioritize verifying exposure, restricting access, and monitoring for suspicious activity.

• Code execution in .php files can bypass access controls
• Obtain sensitive data through file inclusion
• Achieve code execution when .php file types can be uploaded and included
• Verify exposure and restrict contributor-level access to mitigate risk

Technical summary

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion due to insufficient validation of the 'theme' parameter. This allows authenticated attackers with contributor-level access to include and execute arbitrary .php files on the server, potentially bypassing access controls, obtaining sensitive data, or achieving code execution when .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint.

Defensive priority

Defenders should prioritize verifying exposure of SiteOrigin Widgets Bundle versions up to 1.73.2, restricting contributor-level access, and monitoring for suspicious widgetData payloads.

Recommended defensive actions

• Verify SiteOrigin Widgets Bundle version and restrict contributor-level access
• Monitor for suspicious widgetData payloads
• Implement additional logging and monitoring for /wp-json/sowb/v1/widgets/previews endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the Local File Inclusion vulnerability in SiteOrigin Widgets Bundle. Contributor-level access and above is required for exploitation. The vulnerability allows attackers to include and execute arbitrary .php files on the server, potentially bypassing access controls, obtaining sensitive data, or achieving code execution. Defenders should verify exposure, restrict contributor-level access, and monitor for suspicious widgetData payloads. The SiteOrigin Widgets Bundle plugin for WordPress is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.