A critical Local File Inclusion vulnerability in the Page Builder by SiteOrigin plugin allows authenticated users to achieve remote code execution on affected WordPress sites.

This vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) within the locate_template function. It permits authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server.

The ability to execute arbitrary PHP code on a web server poses a severe threat to business operations, potentially leading to a total compromise of the application environment. An attacker could bypass access controls, exfiltrate sensitive database information, or gain persistent control over the host server. Given the CVSS score of 8.8, this vulnerability is considered High severity and requires prompt attention to prevent unauthorized system access.

Immediate Action: Update the Page Builder by SiteOrigin plugin to the latest version, which contains the security patch for the locate_template function.

Proactive Monitoring: Monitor server access logs for suspicious file inclusion attempts or requests directed toward unusual PHP file paths.

Compensating Controls: Ensure that WordPress user roles are strictly managed and that untrusted users are not granted Contributor-level access or higher. A Web Application Firewall (WAF) may assist in blocking malicious path traversal patterns targeting this plugin.

Public Exploit Available: Unknown.

Organizations utilizing the Page Builder by SiteOrigin plugin must prioritize applying the latest security updates immediately. Because this vulnerability allows for code execution by authenticated contributors, the risk to the integrity and confidentiality of the WordPress environment is significant. Administrators should verify the plugin version and perform the update as part of their standard patch management cycle to eliminate this exposure.