« Volver al listado

CVE-2026-97348

Estado: AplazadaMedia (6.5)—

El plugin SiteOrigin Widgets Bundle para WordPress es vulnerable a Directory Traversal en todas las versiones hasta e incluyendo la 1.74.3 a través de la función get_instance_css. Esto hace posible que atacantes autenticados, con acceso de nivel contribuidor y superior, lean el contenido de archivos arbitrarios en el servidor, que pueden contener información sensible. La canalización normal de actualización()/sanitize_field_input() del widget —que rechazaría valores de color no hexadecimales— se omite completamente porque el controlador del shortcode [siteorigin_widget] llama a $the_widget->widget() directamente en la instancia JSON decodificada suministrada por el atacante.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de traversal de directorios en plugin WordPress accesible a atacantes autenticados (PR:L) vía función get_instance_css, permitiendo lectura de archivos arbitrarios del servidor con información sensible.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementUpdate SoftwareActive Directory ConfigurationVulnerability ScanningUser TrainingThreat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Siteorigin — Siteorigin Widgets BundleAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-97348",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-97348",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-11T16:42:17.505527Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "gpriday",
          "product": "SiteOrigin Widgets Bundle",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "1.74.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-10T07:16:42.900",
  "references": [
    {
      "url": "https://github.com/siteorigin/so-widgets-bundle/compare/540f834469fe...bf80892709fb",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/inc/shortcode.php#L31",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/inc/shortcode.php#L51",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/siteorigin-widget.class.php#L1006",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/siteorigin-widget.class.php#L1117",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/siteorigin-widget.class.php#L1134",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.74.3/base/siteorigin-widget.class.php#L1148",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/3724795/so-widgets-bundle/trunk/base/siteorigin-widget.class.php",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/500f18e6-14ca-4632-9317-5886fa2bb763?source=cve",
      "source": "security@wordfence.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The widget's normal update()/sanitize_field_input() pipeline — which would reject non-hex color values — is bypassed entirely because the [siteorigin_widget] shortcode handler calls $the_widget->widget() directly on the attacker-supplied decoded JSON instance."
    }
  ],
  "lastModified": "2026-10-13T13:29:12.567",
  "sourceIdentifier": "security@wordfence.com"
}