CVE-2026-2448 - Vulnerability Analysis

Overview

SiteOrigin Page Builder for WordPress <= 2.33.5 contains a local file inclusion vulnerability caused by improper handling in locate_template() function, letting authenticated contributors and above execute arbitrary PHP code, exploit requires contributor-level access.

Severity & Score

Impact

Authenticated attackers can execute arbitrary PHP code, bypass access controls, and obtain sensitive data.

Mitigation

Update to a version later than 2.33.5 or the latest available version.

References

• https://www.wordfence.com/threat-intel/vulnerabilities/id/deeeb78d-1757-44ec-968b-968d919b84f1?source=cve
• https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.33.5/inc/widgets/post-loop.php#L576

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner