The Page Builder by SiteOrigin WordPress plugin, prior to version 2.38.0, accepts arbitrary query arguments in its Post Loop widget without proper validation or restriction of query scope. Contributors and higher roles can craft requests that bypass the default post filtering, leading to exposure of draft, pending, scheduled, and private posts and pages. This enables attackers with authorized contribution access to read content they should not normally see. The flaw is rooted in a lack of input validation and access control, aligning with the CWE‑200 Sensitive Data Exposure weakness.

Any WordPress installation that includes the Page Builder by SiteOrigin plugin older than 2.38.0 is impacted. Users with the contributor role or higher who can edit the widget are able to trigger the disclosure. The vulnerability is vendor‑specific to the Page Builder by SiteOrigin plugin; other plugins or themes are not directly affected by this issue.

The vulnerability’s CVSS score is not provided, but the potential to read private content is serious for confidentiality. EPSS information is unavailable, and the flaw is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation yet. Attackers need legitimate contributor access or higher to inject malicious query parameters, after which the plugin will return the query results. The lack of hardening on the widget’s query handling makes exploitation straightforward once the attacker has user credentials with sufficient rights.