Input validation vulnerability in SiteOrigin Widgets Bundle 1.50.1

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to a type of attack called Local File Inclusion. This attack affects all versions of the plugin up to and including 1.50.1. The attack allows anyone who has administrator-level access to the WordPress site to include and execute any file on the server. This includes any type of file, such as images or other “safe” file types, but also any type of PHP code which can be used to bypass access controls, obtain sensitive data, or even gain control of the server.