Widget Options EUVD-2026-114309

Exploitation requires an authenticated account on a target WordPress site running the Widget Options plugin version 4.2.5 or earlier (vendor marketing_fire). The title indicates an Author-level role suffices, though the supplied CVSS sets PR:H - the exact required privilege should be confirmed with Patchstack. Limiting factors: a valid authenticated account is mandatory (PR is not None), so the site must expose account provisioning (e.g. open user registration) or the attacker must already possess credentials; sites not running Widget Options, or running a version above 4.2.5, are unaffected. No user interaction is required (UI:N). The specific plugin feature, parameter, or configuration that triggers the code injection is not described in the available sources.

This is a genuine high-priority issue, corroborated by multiple signals pointing the same direction: the vuln.today decision label is act_now, the CVSS base score is 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - network vector, low complexity, no user interaction, scope-changing total C/I/A loss), and the flaw is CWE-94 code injection yielding remote code execution, which is among the most impactful outcomes for a web application. Countervailing factors temper the urgency: no EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or working exploit was provided - only a Patchstack advisory reference - so there is no evidence of active or at-scale exploitation at this time. One internal inconsistency should be verified with the vendor: the title explicitly describes an 'Author' Remote Code Execution, implying a relatively low-privileged authenticated WordPress role, yet the supplied CVSS vector sets PR:H (high privilege); the required privilege level materially changes real-world exploitability, so reconcile the 'Author' wording against PR:H with Patchstack before finalizing prioritization. Net: treat as act_now for remediation given RCE + act_now label, but note the realistic barrier is that an attacker must already hold a valid authenticated account on the target site.

An attacker who holds (or obtains, e.g. via open registration or credential compromise) an authenticated WordPress account with the required privilege level on a site running Widget Options <= 4.2.5 abuses the plugin to inject code that the server executes, achieving remote code execution. Because the CVSS vector is AV:N/AC:L/UI:N with scope change, exploitation is remote, low-complexity, and requires no victim interaction once the account exists. No verified public exploit code was provided in the input, only a Patchstack advisory reference.