CVE-2026-2448

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2448", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-13T09:44:50.566Z", "datePublished": "2026-03-03T01:21:50.889Z", "dateUpdated": "2026-04-08T17:28:25.701Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:25.701Z"}, "affected": [{"vendor": "gpriday", "product": "Page Builder by SiteOrigin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.33.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locate_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."}], "title": "Page Builder by SiteOrigin <= 2.33.5 - Authenticated (Contributor+) Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/deeeb78d-1757-44ec-968b-968d919b84f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.33.5/inc/widgets/post-loop.php#L576"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "suyoung kim"}], "timeline": [{"time": "2026-01-31T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-13T10:01:01.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-02T13:14:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T16:08:50.312780Z", "id": "CVE-2026-2448", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T16:09:52.692Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2448", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T16:08:50.312780Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T16:09:32.177Z"}}], "cna": {"title": "Page Builder by SiteOrigin <= 2.33.5 - Authenticated (Contributor+) Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "suyoung kim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "gpriday", "product": "Page Builder by SiteOrigin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.33.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-31T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-13T10:01:01.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-02T13:14:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/deeeb78d-1757-44ec-968b-968d919b84f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.33.5/inc/widgets/post-loop.php#L576"}], "descriptions": [{"lang": "en", "value": "The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locate_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:25.701Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2448", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:25.701Z", "dateReserved": "2026-02-13T09:44:50.566Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-03T01:21:50.889Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Page Builder by SiteOrigin", "vendor": "gpriday", "versions": [{"lessThanOrEqual": "2.33.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locate_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."}, {"lang": "es", "value": "El plugin Page Builder by SiteOrigin para WordPress es vulnerable a inclusi\u00f3n local de ficheros en todas las versiones hasta, e incluyendo, la 2.33.5 a trav\u00e9s de la funci\u00f3n locate_template(). Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, incluyan y ejecuten ficheros arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde im\u00e1genes y otros tipos de ficheros 'seguros' pueden ser subidos e incluidos."}], "id": "CVE-2026-2448", "lastModified": "2026-06-17T10:30:58.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2448", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T16:08:50.312780Z", "version": "2.0.3"}}]}, "published": "2026-03-03T02:16:10.687", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.33.5/inc/widgets/post-loop.php#L576"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/deeeb78d-1757-44ec-968b-968d919b84f1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.33.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Page Builder by SiteOrigin", "source": "cna", "vendor": "gpriday"}, "product": "page_builder_by_siteorigin", "vendor": "gpriday"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T16:51:46.394565+00:00", "value": {"mitigation_remediation": ["Upgrade the Page Builder by SiteOrigin plugin to the latest release (>=\u202f2.34), which removes the vulnerable locate_template() call.", "Restrict file uploads to strictly safe file types such as images and set the server\u2019s PHP configuration to disable execution of files in upload directories.", "Apply file system permissions that prevent execute access to the plugin\u2019s template directories, ensuring that even if an inclusion occurs, the PHP interpreter cannot execute the file as code."], "summary": {"action": "Immediate Patch", "impact": "Local File Inclusion leading to arbitrary PHP code execution"}, "threat_synthesis": {"affected_systems": "All installations of the Page Builder by SiteOrigin plugin up to and including version 2.33.5 are impacted. The plugin is distributed under the vendor identifier gpriday and integrates with WordPress sites that permit Contributor or higher roles.", "description_and_impact": "The Page Builder by SiteOrigin plugin for WordPress contains a flaw in its locate_template() usage that permits Local File Inclusion (CWE\u201122). When the vulnerable function attempts to load a template file, it accepts a user\u2011controlled path that can reference any file on the server. An authenticated user with Contributor privileges can trigger this behavior to include and execute arbitrary files, effectively bypassing the plugin\u2019s access controls, exposing sensitive server files, or running malicious PHP code.", "risk_and_exploitability": "This vulnerability receives a CVSS score of 8.8, indicating high severity, but the EPSS score is reported as less than 1%, suggesting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploits. Exploitation requires an authenticated account with Contributor or higher access, after which the attacker can upload a harmless file (e.g., an image) and adjust plugin settings to trigger locate_template(), thereby causing the server to process the file as PHP code."}}}}, "created": "2026-03-04T14:54:35.885704+00:00", "updated": "2026-04-15T17:00:07.069037+00:00", "vendors": ["gpriday", "gpriday$PRODUCT$page_builder_by_siteorigin", "wordpress", "wordpress$PRODUCT$wordpress"]}