CVE-2026-2127: 
WordPress vulnerability analysis and mitigation

CVE-2026-2127 is a Missing Authorization vulnerability in the SiteOrigin Widgets Bundle plugin for WordPress that allows authenticated attackers with Subscriber-level access or above to execute arbitrary shortcodes. All versions up to and including 1.70.4 are affected. The vulnerability was published on February 18, 2026, with a CVSS v3.1 base score of 5.4 (Medium) (Red Hat CVE).

The root cause is a missing capability check (CWE-862: Missing Authorization) on the siteorigin_widget_preview_widget_action() function, which is registered via the wp_ajax_so_widgets_preview AJAX action. The function only verifies a nonce (widgets_action) but does not enforce any WordPress user capability checks, allowing any authenticated user to invoke it. Critically, the required nonce is exposed publicly on the frontend whenever the Post Carousel widget is present on a page — it is embedded in the data-ajax-url HTML attribute — meaning any authenticated user can retrieve it and invoke the SiteOrigin_Widget_Editor_Widget via the preview endpoint to execute arbitrary shortcodes (Red Hat CVE).

Successful exploitation allows authenticated attackers with minimal privileges (Subscriber-level) to execute arbitrary WordPress shortcodes, potentially leading to limited information disclosure and content integrity violations. The CVSS assessment reflects low confidentiality and low integrity impact with no availability impact, and the scope is unchanged, meaning exploitation is contained to the WordPress application context. Depending on what shortcodes are registered on the target site, the impact could extend to exposing sensitive data or injecting malicious content (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.03%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation does require an authenticated account (Subscriber-level or above), but the nonce exposure on the public frontend lowers the barrier for any registered user (Red Hat CVE).

1. Reconnaissance: Identify a WordPress site running SiteOrigin Widgets Bundle version 1.70.4 or earlier with the Post Carousel widget active on a publicly accessible page.
2. Nonce Extraction: As an unauthenticated or authenticated visitor, view the page source of any page containing the Post Carousel widget and locate the data-ajax-url HTML attribute, which contains the exposed widgets_action nonce value.
3. Authentication: Register or log in to the target WordPress site with any account at Subscriber level or above.
4. Craft Malicious Request: Send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to so_widgets_preview, the extracted nonce, and a payload specifying the SiteOrigin_Widget_Editor_Widget with a desired arbitrary shortcode.
5. Shortcode Execution: The server processes the request without capability checks, executes the specified shortcode, and returns the output — potentially exposing sensitive data or performing unintended site actions (Red Hat CVE).

• Logs: WordPress access logs showing repeated POST requests to /wp-admin/admin-ajax.php with action=so_widgets_preview from low-privilege user accounts, especially in high volume or from unexpected IP addresses.
• Logs: Authentication logs showing Subscriber-level accounts making unusual AJAX requests outside of normal user behavior patterns.
• Network: Unusual outbound connections or data exfiltration originating from the web server following AJAX requests to the preview endpoint.
• Application: Unexpected shortcode output appearing in server responses or logs, particularly shortcodes that access user data, file contents, or external resources.

Users should update the SiteOrigin Widgets Bundle plugin to a version beyond 1.70.4 that includes a capability check on the siteorigin_widget_preview_widget_action() function. As an interim workaround, site administrators can disable the Post Carousel widget to prevent nonce exposure on the frontend, or restrict user registration to reduce the pool of potential authenticated attackers. Monitoring AJAX logs for suspicious so_widgets_preview requests is also recommended (Red Hat CVE, Sucuri Blog).

Sucuri included CVE-2026-2127 in their February 2026 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). Red Hat tracked the vulnerability in their CVE database, though no specific Red Hat products were identified as affected. No significant social media discussion or notable researcher commentary beyond standard vulnerability aggregation has been observed.