Information disclosure in Page Builder By Siteorigin

CVE-2026-110507

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.

Vulnerability class: Information Disclosure

Published · last modified .

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.002 (4.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 4.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

  • Page Builder By Siteorigin

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-110507?
CVE-2026-110507 is a low-severity vulnerability in Page Builder By Siteorigin, classified under Information Disclosure. CVSS score: 2.7/10. Published 2026-10-28.
How severe is CVE-2026-110507?
Low severity. CVSS v3 base score is 2.7 out of 10.