CVEvulnerability

CVE-2023-6295

7.2 HIGH Published 2023-12-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.

Affected configurations

• siteorigin siteorigin widgets bundle (< 1.51.0)

References