CVE-2026-2127

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2127", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-06T19:20:41.302Z", "datePublished": "2026-02-18T08:26:04.127Z", "dateUpdated": "2026-04-08T17:19:28.822Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:28.822Z"}, "affected": [{"vendor": "gpriday", "product": "SiteOrigin Widgets Bundle", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.70.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4. This is due to a missing capability check on the `siteorigin_widget_preview_widget_action()` function which is registered via the `wp_ajax_so_widgets_preview` AJAX action. The function only verifies a nonce (`widgets_action`) but does not check user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes by invoking the `SiteOrigin_Widget_Editor_Widget` via the preview endpoint. The required nonce is exposed on the public frontend when the Post Carousel widget is present on a page, embedded in the `data-ajax-url` HTML attribute."}], "title": "SiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bf92c64b-ca76-4af7-a1e4-585a60b03153?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/base/inc/actions.php#L6"}, {"url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/base/inc/actions.php#L75"}, {"url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/widgets/post-carousel/post-carousel.php#L590"}, {"url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/widgets/editor/editor.php#L120"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3460939%40so-widgets-bundle%2Ftrunk&old=3434183%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Hung Nguyen"}], "timeline": [{"time": "2026-02-06T19:36:17.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-17T20:23:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T12:24:54.913294Z", "id": "CVE-2026-2127", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:51:34.763Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2127", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T12:24:54.913294Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:24:55.752Z"}}], "cna": {"title": "SiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution", "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Ba Hung"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "gpriday", "product": "SiteOrigin Widgets Bundle", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.70.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-06T19:36:17.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-17T20:23:18.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bf92c64b-ca76-4af7-a1e4-585a60b03153?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/base/inc/actions.php#L6"}, {"url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/base/inc/actions.php#L75"}, {"url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/widgets/post-carousel/post-carousel.php#L590"}, {"url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/widgets/editor/editor.php#L120"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3460939%40so-widgets-bundle%2Ftrunk&old=3434183%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4. This is due to a missing capability check on the `siteorigin_widget_preview_widget_action()` function which is registered via the `wp_ajax_so_widgets_preview` AJAX action. The function only verifies a nonce (`widgets_action`) but does not check user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes by invoking the `SiteOrigin_Widget_Editor_Widget` via the preview endpoint. The required nonce is exposed on the public frontend when the Post Carousel widget is present on a page, embedded in the `data-ajax-url` HTML attribute."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-18T08:26:04.127Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2127", "state": "PUBLISHED", "dateUpdated": "2026-02-18T12:51:34.763Z", "dateReserved": "2026-02-06T19:20:41.302Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T08:26:04.127Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SiteOrigin Widgets Bundle", "vendor": "gpriday", "versions": [{"lessThanOrEqual": "1.70.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4. This is due to a missing capability check on the `siteorigin_widget_preview_widget_action()` function which is registered via the `wp_ajax_so_widgets_preview` AJAX action. The function only verifies a nonce (`widgets_action`) but does not check user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes by invoking the `SiteOrigin_Widget_Editor_Widget` via the preview endpoint. The required nonce is exposed on the public frontend when the Post Carousel widget is present on a page, embedded in the `data-ajax-url` HTML attribute."}, {"lang": "es", "value": "El plugin SiteOrigin Widgets Bundle para WordPress es vulnerable a la ejecuci\u00f3n arbitraria no autorizada de shortcodes en todas las versiones hasta la 1.70.4, inclusive. Esto se debe a una verificaci\u00f3n de capacidad faltante en la funci\u00f3n `siteorigin_widget_preview_widget_action()` que est\u00e1 registrada a trav\u00e9s de la acci\u00f3n AJAX `wp_ajax_so_widgets_preview`. La funci\u00f3n solo verifica un nonce (`widgets_action`) pero no comprueba las capacidades del usuario. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, ejecuten shortcodes arbitrarios invocando el `SiteOrigin_Widget_Editor_Widget` a trav\u00e9s del endpoint de vista previa. El nonce requerido est\u00e1 expuesto en el frontend p\u00fablico cuando el widget Post Carousel est\u00e1 presente en una p\u00e1gina, incrustado en el atributo HTML `data-ajax-url`."}], "id": "CVE-2026-2127", "lastModified": "2026-06-17T10:30:21.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2127", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T12:24:54.913294Z", "version": "2.0.3"}}]}, "published": "2026-02-18T09:15:58.817", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/base/inc/actions.php#L6"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/base/inc/actions.php#L75"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/widgets/editor/editor.php#L120"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.70.4/widgets/post-carousel/post-carousel.php#L590"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3460939%40so-widgets-bundle%2Ftrunk&old=3434183%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bf92c64b-ca76-4af7-a1e4-585a60b03153?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.70.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "siteorigin_widgets_bundle", "vendor": "gpriday"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 70.0, "confidence_source": "inferred", "scores": [{"score": 70.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:06:06.035439+00:00", "value": {"mitigation_remediation": ["Upgrade SiteOrigin Widgets Bundle to the latest release that includes the missing capability check for the preview AJAX action.", "If an immediate upgrade is not possible, restrict access to the wp_ajax_so_widgets_preview endpoint by adding a capability check that allows only users with higher permissions (e.g., Editor or Administrator).", "Disable the Post Carousel widget or remove the widget from pages that are publicly accessible to eliminate exposure of the required nonce to unauthenticated visitors."], "summary": {"action": "Apply Patch", "impact": "Arbitrary Shortcode Execution by Authenticated Users"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the SiteOrigin Widgets Bundle plugin up to and including version 1.70.4. The plugin is published by gpriday and is widely used within WordPress installations that enable the Post Carousel widget or any widget that registers Ajax actions.\n", "description_and_impact": "The SiteOrigin Widgets Bundle plugin for WordPress allows any authenticated user with Subscriber role or higher to invoke an AJAX endpoint that renders arbitrary shortcodes. The lack of a capability check means that by simply calling the preview action, an attacker can supply any shortcode content and have it executed on the site\u2019s frontend. This flaw is categorized as CWE\u2011862 (Missing Authorization). The ability to run arbitrary shortcodes can lead to content manipulation, disclosure of sensitive information embedded in shortcodes, or even execution of malicious PHP code if the attacker crafts a shortcode that triggers such behavior, thereby compromising site integrity and availability.\n", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate severity level. The EPSS score of less than 1% suggests that the probability of an active exploitation is very low at the time of this assessment. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must be authenticated as a Subscriber or higher, so the attack surface is limited to legitimate user accounts. Once the preview endpoint is accessed, the boundary condition between the site and the attacker is the rendering of arbitrary shortcodes, with no requirement for additional exploits. Therefore, while the risk is moderate and exploitation likelihood is low, the impact to site integrity could be significant if an attacker can inject malicious shortcodes.\n"}}}}, "created": "2026-02-19T10:20:32.256086+00:00", "updated": "2026-04-15T17:30:10.434904+00:00", "vendors": ["gpriday", "gpriday$PRODUCT$siteorigin_widgets_bundle", "wordpress", "wordpress$PRODUCT$wordpress"]}