SiteOrigin Page Builder EUVD-2026-111711

Exploitation requires an authenticated WordPress account with the contributor role or higher on a site running Page Builder by SiteOrigin before 2.38.0. The attacker then uses the plugin's Post Loop widget, which fails to restrict the query arguments a user may add and does not limit the loop to posts the user is allowed to read; this is the exact condition that enables disclosure. Limiting factors: the site must grant untrusted parties contributor-or-above accounts, there must be other users' unpublished (draft, pending, scheduled, or private) content to expose, and the impact is read-only - no modification or denial of service is possible. The supplied vector marks the privilege barrier as PR:H while the description names 'contributor' as sufficient, so the true minimum privilege should be confirmed.

This is a low-severity information-disclosure issue (CVSS 2.7) that is confirmed by the vulnerability signals to be a low priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:H/UI:N, scope unchanged, C:L/I:N/A:N) describes an authenticated, network-reachable read-only disclosure with no integrity or availability impact. EPSS is very low (0.16%, 5th percentile) and there is no CISA KEV listing, so there is no sign of active exploitation. No public exploit was identified in the provided data. The vuln.today decision label is 'monitor', consistent with all signals pointing the same direction: a genuine but minor confidentiality leak gated behind an authenticated contributor-or-higher account. One internal inconsistency is worth noting for verification: the supplied CVSS marks PR:H, yet the description says the lowest exploiting role is 'contributor', which is a low-privilege author role in WordPress - PR:L would be more defensible, which would slightly raise the real-world accessibility of the flaw. Overall this is a legitimately low-risk, low-impact issue best handled via routine patching rather than emergency response.

An attacker who already holds a contributor (or higher) account on a WordPress site running Page Builder by SiteOrigin adds a Post Loop widget and supplies query arguments that are not restricted to content the user is permitted to see. By doing so they retrieve the text of other users' draft, pending, scheduled, and private posts and pages. No public exploit code was identified, and exploitation requires a pre-existing authenticated account.