Description
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | SiteOrigin Widgets Bundle | < 1.51.0 | 1.51.0 |
References
- https://wpscan.com/vulnerability/adc9ed9f-55b4-43a9-a79d-c7120764f47c exploit vdb-entry technical-description