SiteOrigin Widgets Bundle EUVD-2026-96222

Requires an authenticated WordPress account at contributor level or above on a site with SiteOrigin Widgets Bundle ≤1.74.3 installed and active, and the ability to use the [siteorigin_widget] shortcode (available to contributors by default). The specific technical condition is that the shortcode handler in base/inc/shortcode.php calls $the_widget->widget() directly on the attacker-controlled decoded JSON instance, bypassing the update()/sanitize_field_input() hex-color validation that normally guards get_instance_css. Limiting factors: exploitation is gated on obtaining a contributor+ account (most impactful where open user registration or many low-trust authors exist), it yields read-only file disclosure (no write/RCE directly), and it requires no user interaction (UI:N).

This is a credible but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a remotely reachable, low-complexity arbitrary file read, but the PR:L requirement (contributor-level account and above) is the dominant limiting factor - this is not an unauthenticated flaw. Impact is confidentiality-only (C:H, I:N, A:N): an attacker can read sensitive files such as wp-config.php (database credentials, auth salts) but cannot directly modify data or cause denial of service, though disclosed credentials could enable follow-on compromise. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding originates from Wordfence threat intelligence research rather than incident response. No signals conflict here: the CVSS vector, the description (contributor-level authenticated access), and the referenced source code all consistently point to an authenticated, network-reachable confidentiality flaw. The realistic risk is elevated on sites that allow contributor self-registration or have many low-trust authors, and low on tightly controlled single-author sites.

An attacker who holds (or registers for) a contributor-level WordPress account on a site running SiteOrigin Widgets Bundle ≤1.74.3 submits a [siteorigin_widget] shortcode whose decoded JSON instance carries a directory-traversal path in a field expected to hold a CSS/color value. Because the shortcode handler invokes the widget's widget() method directly on the attacker-supplied instance, the normal update()/sanitize_field_input() validation that would reject the malformed value is bypassed, and get_instance_css reads an arbitrary file (e.g. wp-config.php) whose contents are exposed. No public exploit was identified at time of analysis, and low attack complexity (AC:L) means the request requires no special timing or race conditions.