blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-110507

LOW 2.7 CVSS 3.1
Published
October 28, 2026
Last modified
October 28, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-200
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Description

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Page Builder by SiteOrigin — Before 2.38.0

References

  • wpscan.com https://wpscan.com/vulnerability/613db16a-e1d2-4cdd-8c5c-e370634887a8/
  • nvd.nist.gov Official NVD record