{"id":"CVE-2026-97348","summary":"SiteOrigin Widgets Bundle \u003c= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)","details":"The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The widget's normal update()/sanitize_field_input() pipeline — which would reject non-hex color values — is bypassed entirely because the [siteorigin_widget] shortcode handler calls $the_widget-\u003ewidget() directly on the attacker-supplied decoded JSON instance.","modified":"2026-10-13T02:30:15.315011111Z","published":"2026-10-10T06:40:10.233Z","database_specific":{"cna_assigner":"Wordfence","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97348.json"},"references":[{"type":"WEB","url":"https://github.com/siteorigin/so-widgets-bundle/compare/540f834469fe...bf80892709fb"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/inc/shortcode.php#L31"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/inc/shortcode.php#L51"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/siteorigin-widget.class.php#L1006"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/siteorigin-widget.class.php#L1117"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/siteorigin-widget.class.php#L1134"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/siteorigin-widget.class.php#L1148"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/changeset/3724795/so-widgets-bundle/trunk/base/siteorigin-widget.class.php"},{"type":"WEB","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/500f18e6-14ca-4632-9317-5886fa2bb763?source=cve"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97348.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97348"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/siteorigin/so-widgets-bundle","events":[{"introduced":"0"},{"last_affected":"c587bfc2f7e92af5d2b4dbac3a9ebc617f1c5d85"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.74.3"}],"source":"AFFECTED_FIELD"}}],"versions":["1.74.3","1.74.2","1.74.1","1.74.0","1.73.2","1.73.1","1.73.0","1.72.0","1.71.0","1.70.4","1.70.3","1.70.2","1.70.1","1.70.0","1.69.3","1.69.2","1.69.1","1.69.0","1.68.5","1.68.4","1.68.3","1.68.2","1.68.1","1.68.0","1.67.2","1.67.1","1.67.0","1.66.0","1.65.1","1.65.0","1.64.2","1.64.1","1.64.0","1.63.4","1.63.3","1.63.2","1.63.1","1.63.0","1.62.3","1.62.1","1.62.0","1.61.1","1.61.0","1.60.0","1.49.0","1.48.0","1.47.1","1.47.0","1.46.7","1.46.6","1.46.5","1.46.4","1.46.3","1.16.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97348.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}