The SiteOrigin Widgets Bundle plugin for WordPress allows any authenticated user with Subscriber role or higher to invoke an AJAX endpoint that renders arbitrary shortcodes. The lack of a capability check means that by simply calling the preview action, an attacker can supply any shortcode content and have it executed on the site’s frontend. This flaw is categorized as CWE‑862 (Missing Authorization). The ability to run arbitrary shortcodes can lead to content manipulation, disclosure of sensitive information embedded in shortcodes, or even execution of malicious PHP code if the attacker crafts a shortcode that triggers such behavior, thereby compromising site integrity and availability.

The vulnerability affects all releases of the SiteOrigin Widgets Bundle plugin up to and including version 1.70.4. The plugin is published by gpriday and is widely used within WordPress installations that enable the Post Carousel widget or any widget that registers Ajax actions.

The CVSS score of 5.4 indicates a moderate severity level. The EPSS score of less than 1% suggests that the probability of an active exploitation is very low at the time of this assessment. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must be authenticated as a Subscriber or higher, so the attack surface is limited to legitimate user accounts. Once the preview endpoint is accessed, the boundary condition between the site and the attacker is the rendering of arbitrary shortcodes, with no requirement for additional exploits. Therefore, while the risk is moderate and exploitation likelihood is low, the impact to site integrity could be significant if an attacker can inject malicious shortcodes.