CVE-2024-54268: SiteOrigin Widgets Bundle Auth Bypass

CVE-2024-54268 Overview

CVE-2024-54268 is a missing authorization vulnerability in the SiteOrigin Widgets Bundle plugin for WordPress. The flaw affects all versions up to and including 1.64.0. Attackers with low-privilege authenticated access can exploit incorrectly configured access control checks to perform actions restricted to higher-privileged users. The issue is categorized under CWE-862: Missing Authorization.

The SiteOrigin Widgets Bundle is a widely deployed WordPress plugin that provides customizable widgets for page builders. Because the plugin runs inside WordPress installations, successful exploitation can compromise site integrity, confidentiality, and availability.

Critical Impact
Authenticated attackers with minimal privileges can bypass access control on the SiteOrigin Widgets Bundle plugin and reach functionality intended for administrators.

Affected Products

SiteOrigin Widgets Bundle (so-widgets-bundle) plugin for WordPress
All versions from initial release through 1.64.0
WordPress sites running the vulnerable plugin with any authenticated user role

Discovery Timeline

2024-12-13 - CVE-2024-54268 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54268

Vulnerability Analysis

The vulnerability stems from broken access control in the SiteOrigin Widgets Bundle plugin. The plugin exposes functionality that fails to verify whether the calling user holds sufficient capabilities before executing sensitive operations. Attackers exploit this gap by invoking those endpoints with a low-privilege authenticated session, such as a subscriber account.

The attack is network-reachable and requires low attack complexity. User interaction is not required, and impact spans confidentiality, integrity, and availability. According to Patchstack's advisory, the flaw is a broken access control issue affecting the plugin through version 1.64.0.

The EPSS probability score is 0.592% at the 45.53 percentile. No public proof-of-concept exploit is currently indexed in Exploit-DB, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing authorization checks on plugin actions. WordPress plugins typically enforce access using current_user_can() capability checks and check_ajax_referer() nonce validation. When either check is absent or evaluated incorrectly, actions become reachable by any authenticated user regardless of assigned role.

Attack Vector

An attacker registers or obtains a low-privilege WordPress account on the target site. The attacker then sends crafted HTTP requests to the plugin's exposed endpoints. Because the plugin does not enforce the correct capability, the requests succeed and execute operations reserved for administrators or editors.

Exploitation code is not available. See the Patchstack Vulnerability Advisory for further technical detail.

Detection Methods for CVE-2024-54268

Indicators of Compromise

Requests to admin-ajax.php or wp-json endpoints referencing so-widgets-bundle from accounts with subscriber or contributor roles
Unexpected modifications to widget configurations, options tables, or plugin settings
New administrative or elevated accounts created shortly after suspicious plugin traffic

Detection Strategies

Audit WordPress access logs for authenticated requests to SiteOrigin Widgets Bundle endpoints originating from low-privilege sessions
Correlate plugin-related POST requests with subsequent changes in wp_options or user capability tables
Deploy a web application firewall with rules that flag broken access control patterns against WordPress plugins

Monitoring Recommendations

Enable WordPress audit logging to capture role changes, option updates, and plugin actions
Alert on any subscriber-level account invoking plugin AJAX handlers or REST routes
Monitor outbound requests from the WordPress host for signs of post-exploitation activity

How to Mitigate CVE-2024-54268

Immediate Actions Required

Update SiteOrigin Widgets Bundle to a version later than 1.64.0 on all WordPress instances
Review existing user accounts and remove unused or unknown low-privilege registrations
Rotate credentials for administrative accounts if suspicious plugin activity is present in logs

Patch Information

SiteOrigin has released a fixed version of the so-widgets-bundle plugin. Site administrators should install the latest release through the WordPress plugin dashboard or by downloading it directly from the plugin repository. Refer to the Patchstack advisory for the fixed version reference.

Workarounds

Disable the SiteOrigin Widgets Bundle plugin until it can be updated
Restrict new user registration on affected WordPress sites to reduce the attacker pool
Apply WAF rules that block unauthenticated or low-privilege access to plugin AJAX endpoints

bash

# Update SiteOrigin Widgets Bundle via WP-CLI
wp plugin update so-widgets-bundle

# Verify installed version is above 1.64.0
wp plugin get so-widgets-bundle --field=version

# Temporarily deactivate the plugin if patching is delayed
wp plugin deactivate so-widgets-bundle