Widget Options EUVD-2026-26754

Requires authenticated access to the target WordPress installation with at least Contributor-level privileges (PR:L), which grants the ability to create and edit posts/blocks but not publish them without approval. The Display Logic feature must be actively used or available in the Widget Options plugin installation. Exploitation specifically targets the extended_widget_opts_block attribute which lacks proper authorization enforcement, meaning Contributor users can supply malicious expressions that should be restricted to Administrators. No user interaction required (UI:N) once the attacker has Contributor access. The vulnerability is not exploitable against default WordPress configurations that do not have the Widget Options plugin installed, and is limited to WordPress environments specifically using this third-party plugin for widget conditional visibility management. Sites that do not permit Contributor registration or tightly control user role assignments reduce the attack surface but remain vulnerable if Contributor accounts exist.

The CVSS v3.1 score of 8.8 (High) reflects the severe technical impact (complete confidentiality, integrity, and availability compromise) with straightforward exploitation requirements (AV:N/AC:L/PR:L/UI:N). Attack complexity is low and requires only low-privilege authentication (Contributor role), making this exploitable by users who can create draft posts in WordPress. No EPSS score provided for probability assessment, and no CISA KEV listing indicates this is not confirmed as actively exploited in the wild. However, the partial patch in version 4.2.0 followed by additional fixes in changesets 3481338 and 3514411 suggests ongoing remediation efforts, indicating the vulnerability may still be present in intermediate versions. Real-world risk is HIGH for WordPress sites where Contributor-level accounts exist (common in multi-author blogs, news sites, community platforms) because the privilege requirement is minimal and the impact is total system compromise. The absence of public POC reduces immediate weaponization risk but does not eliminate threat from targeted attacks or future POC development. Priority should be HIGH for any WordPress installation using this plugin with untrusted contributors, MEDIUM for tightly controlled author bases.

An attacker registers a Contributor account on a target WordPress site (or compromises existing Contributor credentials via phishing). They create or edit a Gutenberg block or classic widget and inject a malicious Display Logic expression designed to bypass the plugin's input validation by using array_map with string concatenation to construct a PHP command (e.g., system() or exec()). When the widget is rendered or the Display Logic is evaluated server-side via extras.php, the crafted expression passes through eval() and executes arbitrary PHP code with the web server's privileges, allowing the attacker to upload a web shell, exfiltrate the WordPress database including admin credentials, or pivot to the underlying server infrastructure.