CVE-2026-2127 is a missing authorization vulnerability (CWE-862) in the SiteOrigin Widgets Bundle plugin for WordPress. The vulnerability exists in the function siteorigin_widget_preview_widget_action(), which is registered to the wp_ajax_so_widgets_preview AJAX action. This function verifies only a nonce but does not check user capabilities, allowing authenticated users with Subscriber-level privileges or higher to execute arbitrary shortcodes by invoking the SiteOrigin_Widget_Editor_Widget via the preview endpoint. The required nonce is exposed on the public frontend when the Post Carousel widget is present, embedded in the data-ajax-url HTML attribute, facilitating exploitation.

An attacker with at least Subscriber-level access can execute arbitrary shortcodes on the affected WordPress site, potentially leading to unauthorized content manipulation or other impacts depending on the shortcode functionality. The vulnerability does not allow unauthenticated access and does not directly impact availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact.

No official patch or fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level user capabilities if possible and avoid using the Post Carousel widget to reduce nonce exposure. Monitor vendor channels for updates and apply patches promptly once released.