What is the CVSS score of EUVD-2026-39365?

EUVD-2026-39365 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Widget Options are affected by EUVD-2026-39365?

The Widget Options WordPress plugin (versions ≤4.2.3) contains a critical code injection vulnerability allowing authenticated Contributor-level users to execute arbitrary PHP code and fully…

How to fix or mitigate EUVD-2026-39365?

24 hours: Inventory all WordPress installations using Widget Options plugin; immediately deactivate and remove the plugin from affected sites. 7 days: Audit all active Contributor accounts for suspicious activity or recent unauthorized creation; revoke access for unnecessary accounts. 30 days: Confirm plugin removal remains in place; monitor marketingfire vendor advisories for patched version; document approval process for future plugin selections.

Widget Options EUVD-2026-39365

| CVE-2026-54823 CRITICAL

Code Injection (CWE-94)

2026-06-25 Patchstack

GHSA-28rq-6fmf-79j2

WordPress RCE Code Injection Wordpress Plugin Widget Options Marketingfire

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable code injection needing only a Contributor account (PR:L) and no interaction; RCE yields full C/I/A, but I assess S:U as execution stays within the WordPress security authority.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:18 vuln.today

DescriptionCVE.org

Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.

AnalysisAI

Code injection in the Widget Options WordPress plugin (versions <= 4.2.3, by marketingfire) allows authenticated users holding the low-privileged Contributor role to achieve remote code execution on the host. Because exploitation only requires a Contributor account - a role frequently granted on multi-author and membership sites - an attacker who can register or compromise such an account can run arbitrary PHP and fully take over the site. There is no public exploit identified at time of analysis, but the 9.9 CVSS and CWE-94 classification place this at the most severe end of WordPress plugin flaws.

Technical ContextAI

Widget Options is a popular WordPress widget-management plugin (CPE cpe:2.3:a:marketingfire:widget_options) that extends the WordPress widget/sidebar system with display logic, styling, and visibility controls. The flaw is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection), meaning attacker-controlled input reaches a code-evaluation or template/callback sink without adequate sanitization, allowing arbitrary PHP/code to be generated and executed within the WordPress runtime. The Contributor angle is significant: WordPress Contributors can create and edit their own posts/widgets but normally cannot publish or execute code, so a code-injection sink reachable from Contributor-level input represents a substantial privilege boundary violation.

RemediationAI

Update the Widget Options plugin to the latest release above 4.2.3 as soon as the vendor publishes it; no exact fixed version is named in the available data, so confirm the patched version directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/widget-options/vulnerability/wordpress-widget-options-plugin-4-2-3-remote-code-execution-rce-vulnerability) and the plugin's WordPress.org changelog before relying on it - no vendor-released patch version is independently confirmed here. Until a fixed version is verified and applied, reduce exposure by removing or deactivating the Widget Options plugin (this disables its widget-display features site-wide), and tighten the attack surface that makes it reachable: disable open user registration or lower the default new-user role below Contributor, audit and remove untrusted Contributor/Author accounts, and place a virtual patch / WAF rule (for example Patchstack's own mFirewall ruleset) in front of the plugin's vulnerable endpoint. Each control has trade-offs - deactivating the plugin breaks any sidebars/widgets that depend on it, and disabling registration affects legitimate contributors - so test on staging where possible.