What the vulnerability does
01Description
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4. This is due to a missing capability check on the `siteorigin_widget_preview_widget_action()` function which is registered via the `wp_ajax_so_widgets_preview` AJAX action. The function only verifies a nonce (`widgets_action`) but does not check user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes by invoking the `SiteOrigin_Widget_Editor_Widget` via the preview endpoint. The required nonce is exposed on the public frontend when the Post Carousel widget is present on a page, embedded in the `data-ajax-url` HTML attribute.
Explanation of Vulnerability in Simple Terms
02Summary
SiteOrigin Widgets Bundle versions up to 1.70.4 lack proper authorization checks, allowing authenticated users with low privileges to read and modify data they should not access. The vulnerability requires a valid WordPress account but no special interaction. Site administrators should update to a version newer than 1.70.4 to restrict unauthorized data access.
What an attacker can do
03Attacker Capabilities
Read and modify data belonging to other users or the site without proper permission.
Potential impact on your site
04Site Impact
Authenticated users can access and alter sensitive site data beyond their intended permissions.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege WordPress account; no user interaction required.
Key dates
06Disclosure timeline
February 18, 2026
CVE published
April 8, 2026
Record updated
