Widget Options EUVD-2026-39365

Exploitation requires an authenticated WordPress account with at least Contributor privileges (CVSS PR:L), and the target site must be running Widget Options 4.2.3 or earlier. No victim user interaction is needed (UI:N) and the vulnerable functionality is reachable over the network (AV:N) once authenticated. The key limiting factor is therefore account access: sites that disable self-registration, restrict the default role below Contributor, or vet their authors significantly raise the bar, whereas multi-author blogs, membership/community sites, and platforms granting Contributor accounts on signup are directly exposed. The exact plugin feature, parameter, or admin-ajax/REST endpoint that hosts the code-injection sink is not detailed in the available input and should be confirmed from the Patchstack advisory.

All severity signals point the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change and full confidentiality/integrity/availability impact - consistent with RCE. The single discriminating control is PR:L (authentication required): this is NOT an unauthenticated internet-wide bug, so mass automated exploitation is less likely than the raw 9.9 suggests, and real-world risk concentrates on sites that allow Contributor (or higher) registration or have weak account hygiene. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public proof-of-concept is referenced - so exploitation probability cannot be quantified and there is no evidence of active exploitation. Net: a genuine high-priority issue for any multi-author WordPress site running this plugin, but the authentication requirement meaningfully limits opportunistic, internet-scale exploitation compared to an unauthenticated RCE.

An attacker registers (or compromises) a Contributor-level account on a WordPress site running Widget Options <= 4.2.3, then submits crafted widget/option input that is processed by the plugin's vulnerable code-generation sink. The injected payload is evaluated as PHP within the WordPress process, giving the attacker arbitrary code execution and a path to full site takeover. No public proof-of-concept is referenced in the available data, but the low attack complexity (AC:L) and lack of required user interaction make a working exploit straightforward for a knowledgeable attacker once authenticated.