CVE-2023-6295 | BDVDB-2026-219804 Detail

SiteOrigin Widgets Bundle

Description#

The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References#

https://wpscan.com/vulnerability/adc9ed9f-55b4-43a9-a79d-c7120764f47c

Exploit#

https://wpscan.com/vulnerability/adc9ed9f-55b4-43a9-a79d-c7120764f47c

History#

Version 12023-12-18Record published in the CVE List.
Version 22024-08-02Most recent update recorded in the CVE List.