SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection in Widget Style Values
- ID
- WPSEC-2026-0391
- Plugin
- SiteOrigin Widgets Bundle (so-widgets-bundle)
- Affected
- from 1.9.0 before 1.75.0
- Remediation
- Update to 1.75.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- SiteOrigin Widgets Bundle on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-97348, on 2026-10-09.
Description
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to LESS Injection leading to Arbitrary File Read in versions 1.9.0 up to, and including, 1.74.3. This is due to widget setting values, including the Social Media Buttons widget's network colors, being written into the LESS source that the plugin compiles into widget CSS without validation. Widget data supplied through the siteorigin_widget shortcode, and widget block data rendered from its cached markup, reaches the compiler without the widget's field sanitization. This makes it possible for authenticated attackers, with contributor-level access and above, to inject LESS constructs, such as the data-uri() function, that embed the contents of files on the server, like wp-config.php, in the generated CSS.
References
- https://wpsec.com/vuln/WPSEC-2026-0391/
- https://plugins.svn.wordpress.org/so-widgets-bundle/tags/1.75.0/
- https://wordpress.org/plugins/so-widgets-bundle/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS