SiteOrigin Page Builder Vulnerability: Urgent Update Required

A high-severity vulnerability has been discovered in the Page Builder by SiteOrigin WordPress plugin, impacting over 500,000 websites. This marks the third vulnerability identified in the plugin in 2026, prompting immediate action from site owners.

What Does Page Builder by SiteOrigin Do?

Page Builder by SiteOrigin is a popular drag-and-drop layout builder for WordPress. It enables users to create responsive, column-based page designs using standard WordPress widgets, eliminating the need for coding knowledge. Its compatibility with most themes and ease of use have contributed to its widespread adoption by both businesses and individuals.

Vulnerability Details: Local File Inclusion

The vulnerability, rated 8.8 on the Common Vulnerability Scoring System (CVSS) scale, is a Local File Inclusion (LFI) flaw affecting all versions of the plugin up to and including 2.33.5. LFI vulnerabilities allow attackers to force the application to load arbitrary files from the server, potentially leading to serious security breaches.

Contributor-Level Access Required

Exploitation of this vulnerability requires an authenticated attacker with Contributor-level access or higher. A Contributor is a basic WordPress user role that allows content creation and submission, but not publication, meaning administrator access is not required for exploitation.

How the Vulnerability Works

The vulnerability resides within the locate_template() function, which is designed to load approved template files. However, the plugin fails to adequately restrict which files can be included through this function. This allows an attacker to include and potentially execute arbitrary files already present on the server.

According to Wordfence, “The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locate_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.”

Potential Impact

Successful exploitation of this vulnerability could allow attackers to:

• Bypass access controls
• Obtain sensitive data
• Execute arbitrary PHP code on the server, potentially leading to complete site compromise

Affected and Patched Versions

The vulnerability affects Page Builder by SiteOrigin plugin versions 2.33.5 and earlier. The issue has been resolved in version 2.34.0.

Recommended Actions

Site owners currently using Page Builder by SiteOrigin are strongly advised to:

• Update immediately to version 2.34.0 or newer.
• If an immediate update is not possible, disable the plugin until it can be updated.

Staying proactive with security updates is crucial for maintaining the integrity and security of your WordPress website.