Home / Vulnerability Intelligence / CVE-2026-2448

CVE-2026-2448 - Vulnerability Analysis

HighCVSS: 8.8

Last Updated: March 3, 2026

SiteOrigin Page Builder - Local File Inclusion

Published: March 3, 2026Updated: March 3, 2026Remote Exploitable

Overview

SiteOrigin Page Builder for WordPress <= 2.33.5 contains a local file inclusion vulnerability caused by improper handling in locate_template() function, letting authenticated contributors and above execute arbitrary PHP code, exploit requires contributor-level access.

Severity & Score

Severity: High

CVSS Score: 8.8

EPSS Score: 10.0%(Probability of exploitation in next 30 days)

Impact

Authenticated attackers can execute arbitrary PHP code, bypass access controls, and obtain sensitive data.

Mitigation

Update to a version later than 2.33.5 or the latest available version.

References

Social Media Activity(3 posts)

TheHackerWire

@thehackerwire

Mar 3, 2026

🟠 CVE-2026-2448 - High (8.8) The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locate_template() function. This makes it possible for authenticated attackers, with Contributor-level a... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2448/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 3, 2026

View original post

Offensive Sequence

@offseq

Mar 3, 2026

🚨 CVE-2026-2448: HIGH severity path traversal in Page Builder by SiteOrigin (all versions). Contributor+ authentication enables LFI, risking server takeover. No patch yet — restrict permissions, monitor activity, and use a WAF. https://radar.offseq.com/threat/cve-2026-2448-cwe-22-improper-limitation-of-a-path-365740f6 #OffSeq #WordPress #Vuln

View original post

Related Resources

Details

CVE ID: CVE-2026-2448
Severity: High
CVSS Score: 8.8
Type: file_inclusion
Status: unconfirmed
EPSS: 10.0%
Social Posts: 3

CWE

CWE-22

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

10.0%Probability of exploitation in the next 30 days