Live › vulnerability › CVE-2026-110507
Go to dashboardThe Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict query arguments added to its Post Loop widget or limit the loop to posts the user may read. A contributor-role user or higher can read other users' draft, pending, scheduled and private posts and pages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running The Page Builder by SiteOrigin before 2.38.0 that have users with the contributor role or higher. Exposure is about reading drafts and private content through the Post Loop widget, so sites with only administrators or no multi-author content are less exposed. Sites on version 2.38.0 or later are not affected.
No product ranges from the sources yet.
wp plugin get siteorigin-panels --field=version (plugin slug assumed; confirm on the site)2.38.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.
This page as .md · .json · in your agent: get_signal("CVE-2026-110507")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.