What is the CVSS score of CVE-2026-2052?

CVE-2026-2052 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Widget Options are affected by CVE-2026-2052?

The Widget Options WordPress plugin (versions ≤4.2.2) contains a remote code execution vulnerability affecting authenticated users with Contributor-level permissions, allowing arbitrary PHP execution…

How to fix or mitigate CVE-2026-2052?

Within 24 hours: inventory all WordPress installations using Widget Options plugin and document current version numbers; disable or remove the plugin if not critical to operations, or restrict Contributor role permissions immediately. Within 7 days: contact the plugin vendor for patch timeline and evaluate alternative widget management solutions; implement Web Application Firewall (WAF) rules to block requests targeting the extended_widget_opts_block attribute if plugin cannot be removed. Within 30 days: migrate to a patched version (monitor vendor advisory for version ≥4.2.3) once released, or replace with an alternative maintained plugin with equivalent functionality.

Widget Options CVE-2026-2052

EUVD-2026-26754 HIGH

Code Injection (CWE-94)

2026-05-02 Wordfence

RCE WordPress Code Injection

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 08:15 vuln.today

EUVD ID Assigned

May 02, 2026 - 08:00 euvd

EUVD-2026-26754

Analysis Generated

May 02, 2026 - 08:00 vuln.today

CVE Published

May 02, 2026 - 07:46 nvd

HIGH 8.8

DescriptionCVE.org

The Widget Options - Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0.

AnalysisAI

Remote code execution in Widget Options plugin for WordPress (all versions ≤4.2.2) allows authenticated Contributor-level users to execute arbitrary PHP code on the server by bypassing input validation in the Display Logic feature. The plugin's unsafe use of eval() on user-controlled expressions, combined with insufficient authorization checks on the extended_widget_opts_block attribute, enables attackers to chain array_map with string concatenation to bypass blocklists. Version 4.2.0 included a partial patch, indicating the vulnerability remains exploitable in current versions. No CISA KEV listing or public POC identified at time of analysis, but EPSS data not provided for risk calibration.

Technical ContextAI

This vulnerability affects the Widget Options plugin (also known as Widget Options Extended, identified by CPE cpe:2.3:a:marketingfire:widget_options) for WordPress. The root cause is CWE-94 (Code Injection), specifically arising from the plugin's Display Logic feature which uses PHP's eval() function to process user-supplied conditional visibility expressions. The vulnerability exists in two key files: gutenberg-toolbar.php (line 843) and extras.php (lines 495, 534) based on WordPress plugin repository references. The plugin attempts to sanitize Display Logic expressions using a blocklist/allowlist approach, but this protection can be circumvented by chaining array_map() with string concatenation techniques to construct malicious PHP code that passes validation but executes arbitrary commands when eval() processes it. The lack of proper authorization enforcement on the extended_widget_opts_block attribute allows lower-privileged users (Contributors) to supply these malicious expressions, escalating what should be a restricted administrative feature into a privilege escalation and remote code execution vector.

RemediationAI

Upgrade Widget Options plugin to the latest version incorporating changesets 3481338 and 3514411 from the WordPress plugin repository (version number post-4.2.2, verify with WordPress.org plugin page for current stable release). The description indicates version 4.2.0 contained only a partial patch, so versions 4.2.0-4.2.2 remain vulnerable and must be upgraded. Review the specific code changes at https://plugins.trac.wordpress.org/changeset/3481338/ and https://plugins.trac.wordpress.org/changeset/3514411/ to understand the complete fix scope. As an interim compensating control if immediate patching is not feasible, restrict Contributor-level access by demoting untrusted users to Subscriber role or removing accounts entirely, though this breaks legitimate content creation workflows. Alternatively, disable the Display Logic feature entirely if the plugin provides a configuration option to do so, or temporarily deactivate the Widget Options plugin until patching is complete (side effect: all widget conditional visibility rules will stop functioning). Audit WordPress user roles using wp-admin Users panel or WP-CLI to identify all Contributor-level and above accounts, and review recent widget/block configurations for suspicious Display Logic expressions that may indicate prior exploitation attempts.