CVE-2026-2448: SiteOrigin Page Builder RCE Vulnerability

CVE-2026-2448 Overview

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to, and including, 2.33.5 via the locate_template() function. This vulnerability allows authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server, enabling the execution of any PHP code contained in those files. This can be leveraged to bypass access controls, obtain sensitive data, or achieve remote code execution in scenarios where images and other "safe" file types can be uploaded and subsequently included.

Critical Impact

Authenticated attackers can execute arbitrary PHP code on the server, potentially leading to full site compromise, data theft, and lateral movement within the hosting environment.

Affected Products

• Page Builder by SiteOrigin plugin for WordPress versions up to and including 2.33.5
• WordPress installations using vulnerable versions of the SiteOrigin Page Builder plugin
• Sites allowing Contributor-level or higher user access with the vulnerable plugin active

Discovery Timeline

• 2026-03-03 - CVE CVE-2026-2448 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-2448

Vulnerability Analysis

This Local File Inclusion vulnerability resides in the locate_template() function within the Page Builder by SiteOrigin plugin. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal.

The core issue stems from insufficient validation of user-controlled input that determines which template files are loaded and executed. The locate_template() function accepts parameters that, when manipulated by an authenticated attacker, can be used to include files outside the intended template directory structure. This allows attackers to include any PHP file accessible on the server filesystem and execute its contents within the WordPress execution context.

The vulnerability requires authentication at the Contributor level or above, which provides a moderate barrier to exploitation. However, many WordPress sites allow user registration at Contributor level for guest posting or content contribution purposes, significantly expanding the attack surface in multi-user environments.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the locate_template() function within the post-loop.php file. The function fails to adequately restrict or sanitize file path inputs, allowing path traversal sequences or absolute paths to be processed. This enables attackers to escape the intended template directory and include arbitrary files from the server filesystem.

The vulnerable code can be examined in the WordPress Plugin Post Loop Code, which shows the affected locate_template() implementation at line 576. The lack of proper path canonicalization and directory restriction allows authenticated users to manipulate the template path parameter.

Attack Vector

The attack is executed over the network and requires the attacker to be authenticated with at least Contributor-level privileges on the target WordPress installation. The attacker exploits the vulnerability by crafting a malicious request that manipulates the template path parameter passed to the locate_template() function.

The attack chain typically proceeds as follows: First, the attacker uploads a seemingly innocent file (such as an image) that contains embedded PHP code. Then, using the LFI vulnerability, the attacker includes this uploaded file via the locate_template() function, causing the embedded PHP code to be executed. Alternatively, attackers may include existing sensitive files like wp-config.php to extract database credentials and authentication keys, or include system files to gather reconnaissance information.

The vulnerability does not require user interaction and can be exploited with low attack complexity, making it particularly dangerous in environments where user registration is enabled.

Detection Methods for CVE-2026-2448

Indicators of Compromise

• Unusual file access patterns in web server logs, particularly requests to the Page Builder widget endpoints with path traversal sequences (../)
• Unexpected PHP file inclusions or executions originating from the SiteOrigin Panels plugin directory
• Modified or newly created files in upload directories containing PHP code embedded within image files
• Authentication logs showing Contributor-level accounts performing unusual page builder operations

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal attempts targeting SiteOrigin Panels endpoints
• Implement file integrity monitoring on WordPress core files, plugin directories, and upload folders
• Review server logs for requests containing suspicious template path parameters or double-encoded characters
• Deploy SIEM rules to correlate authentication events with subsequent file inclusion activities

Monitoring Recommendations

• Enable verbose logging for WordPress plugin activities and review logs for anomalous template loading behavior
• Configure intrusion detection systems to alert on PHP execution from upload directories
• Monitor for outbound connections from the web server that may indicate successful exploitation and data exfiltration
• Implement real-time alerting for any modifications to critical WordPress configuration files

How to Mitigate CVE-2026-2448

Immediate Actions Required

• Update the Page Builder by SiteOrigin plugin to the latest version that addresses this vulnerability
• Audit all user accounts with Contributor-level access and above, removing unnecessary privileges
• Review server logs for signs of exploitation and investigate any suspicious activity
• Implement additional access controls on file upload directories to prevent PHP execution

Patch Information

Users should update the Page Builder by SiteOrigin plugin to a version newer than 2.33.5 as soon as a patched version is released. Check the official WordPress plugin repository for the latest security updates. Additional details about this vulnerability and remediation guidance can be found in the Wordfence Vulnerability Report.

Workarounds

• Temporarily deactivate the Page Builder by SiteOrigin plugin until a patched version is available
• Restrict user registration and limit the number of accounts with Contributor-level access or above
• Deploy a Web Application Firewall (WAF) rule to block requests containing path traversal sequences targeting the affected endpoints
• Configure server-level restrictions to prevent PHP execution in upload directories using .htaccess or server configuration

# Apache configuration to prevent PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    php_admin_flag engine off
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>