Vulnerability · Published Oct 28, 2026 · Assigned by WPScan
CVE-2026-110507Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments
Low 2.7
In plain English
A low-severity information exposure in Page Builder by SiteOrigin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Page Builder by SiteOrigin | 0 – before 2.38.0 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/613db16a-e1d2-4cdd-8c5c-e370634887a8/ exploit, vdb-entry, technical-description