title: so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion
description: The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
vendor: Unknown
product: SiteOrigin Widgets Bundle
versions:
status: affected, versionType: semver, version: 0, lessThan: 1.51.0
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}