The Page Builder by SiteOrigin plugin for WordPress contains a flaw in its locate_template() usage that permits Local File Inclusion (CWE‑22). When the vulnerable function attempts to load a template file, it accepts a user‑controlled path that can reference any file on the server. An authenticated user with Contributor privileges can trigger this behavior to include and execute arbitrary files, effectively bypassing the plugin’s access controls, exposing sensitive server files, or running malicious PHP code.

All installations of the Page Builder by SiteOrigin plugin up to and including version 2.33.5 are impacted. The plugin is distributed under the vendor identifier gpriday and integrates with WordPress sites that permit Contributor or higher roles.

This vulnerability receives a CVSS score of 8.8, indicating high severity, but the EPSS score is reported as less than 1%, suggesting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploits. Exploitation requires an authenticated account with Contributor or higher access, after which the attacker can upload a harmless file (e.g., an image) and adjust plugin settings to trigger locate_template(), thereby causing the server to process the file as PHP code.