Threats tagged 'ghsa-vc58-2rcj-cgf8'

The SiteOrigin Widgets Bundle WordPress plugin up to version 1.73.2 contains a Local File Inclusion vulnerability via the 'theme' parameter. Authenticated users with contributor-level access or higher can exploit this flaw to include and execute arbitrary PHP files on the server. This allows execution of arbitrary PHP code, potentially bypassing access controls and exposing sensitive data. Exploitation involves sending a crafted widgetData payload to a specific REST endpoint, bypassing field validation.