SiteOrigin Widgets Bundle EUVD-2026-91178

Exploitation requires an authenticated WordPress account with contributor-level privileges or higher (PR:L). The attacker must send a crafted widgetData payload that includes a legacy top-level 'theme' key together with a non-empty 'columns' array to the /wp-json/sowb/v1/widgets/previews REST endpoint; this specific structure is what bypasses field validation because update_fields() only processes declared form fields. Pure LFI (including/executing .php files already present on the server) works against default installs of affected versions (≤1.73.2), but achieving arbitrary attacker-controlled PHP code execution additionally requires a path to upload a .php file that can then be included. Limiting factors: the contributor-authentication barrier, the need for a precisely malformed payload (reflected in AC:H), and dependency on an uploadable .php file for the maximal RCE impact.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network reachability via the /wp-json/sowb/v1/widgets/previews REST endpoint, but two signals temper it: PR:L requires authenticated contributor-level access (not anonymous), and AC:H reflects the crafted widgetData payload needed to bypass update_fields() validation. No EPSS score, KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding was reported by Wordfence (a credible plugin-security source) via its threat-intel database. The C:H/I:H/A:H impact is achievable because LFI of attacker-controllable .php files yields arbitrary code execution, but note the description explicitly conditions full code execution on 'cases where .php file types can be uploaded and included' - so the worst-case RCE outcome depends on a secondary upload capability, while pure LFI of existing server .php files is always available. Net: credible authenticated LFI-to-RCE in a very widely installed plugin, meriting prompt patching, but the contributor-auth requirement and absence of exploitation signals place it below an unauthenticated-RCE emergency.

An attacker who holds or phishes a WordPress contributor account sends a malicious widgetData payload containing a legacy top-level 'theme' key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, bypassing field validation. The supplied path is used to include a .php file on the server, executing its code; where the attacker can also upload a .php file (e.g., via a permissive media or import feature), this escalates to arbitrary remote code execution. No public exploit code was identified in the provided data.