SiteOrigin Widgets Bundle < 1.74.0 - Contributor+ LFI via 'theme' Parameter

Description

The plugin is vulnerable to Local File Inclusion via the 'theme' parameter, allowing authenticated attackers with contributor-level access and above to include and execute arbitrary .php files on the server, and thereby execute any PHP code in those files. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because update_fields() only processes declared form fields.