CVE-2023-6295 (published 2023-12-18T20:08:01.584Z)
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
Affected products: Vendor: Unknown
Product: SiteOrigin Widgets Bundle
Versions: 0