CVE-2026-97348

Name of the Vulnerable Software and Affected Versions SiteOrigin Widgets Bundle versions prior to 1.74.4

Description An issue exists where authenticated attackers with contributor-level access and above can read arbitrary files on the server, potentially exposing sensitive information. This occurs because the [siteorigin widget] shortcode handler calls the widget() function directly on a decoded JSON instance provided by the attacker, bypassing the standard update() and sanitize field input() pipeline that normally rejects non-hex color values. The flaw is triggered via the get instance css() function, leading to Directory Traversal, a method used to access files and directories that are stored outside the web root folder.

Recommendations Update SiteOrigin Widgets Bundle to version 1.74.4 or later.