EUVD-2026-42161
GHSA-q799-r857-2h8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable AJAX action, low complexity, and only subscriber authentication (PR:L) yield full code-execution impact (C:H/I:H/A:H) with no scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequent use in an eval() call. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.
AnalysisAI
Remote code execution in the Widget Logic Visual WordPress plugin (all versions through 1.52) lets low-privileged authenticated users run arbitrary PHP on the server. The flaw stems from the widget-logic-update-conditional-tags AJAX action lacking a capability check and nonce verification, allowing any subscriber-and-above account to store attacker-controlled data in the 'nwlv[cod-tag]' parameter that is later passed to an eval() call by widget_logic_visual_check_visibility. Reported by Wordfence with no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
The affected component is a WordPress plugin (CPE cpe:2.3:a:totalbounty:widget_logic_visual) that controls widget visibility using PHP-style conditional tags. Those conditional tags are evaluated at runtime through PHP's eval() construct in custom.php (around line 50), which turns any stored tag value into executable code. The AJAX handler in ajax.php that saves these tags (widget-logic-update-conditional-tags, around lines 14 and 91) omits both a current_user_can() capability gate and a check_ajax_referer() nonce check, so the write path is exposed to any logged-in user regardless of role. Although the record is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and tagged 'File Upload', the described mechanism is server-side code injection via eval() (functionally CWE-94/CWE-95), making the 'file upload' framing imprecise for this case.
RemediationAI
No vendor-released patched version was identified at time of analysis - the references point to the plugin's WordPress trac trunk source rather than a tagged fixed release, so administrators should monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/5d82e9e2-c572-4911-a6a5-1384844214b0) and the plugin's WordPress.org page for a release above 1.52 and apply it as soon as it ships. Until a fix exists, the most effective compensating control is to deactivate and remove the Widget Logic Visual plugin, which eliminates the eval() sink entirely at the cost of losing conditional widget-visibility functionality. If removal is not acceptable, restrict who can obtain accounts by disabling open user registration (Settings > General > 'Anyone can register') and auditing existing low-privilege accounts, since exploitation requires an authenticated subscriber; additionally, block or filter POST requests to admin-ajax.php carrying action=widget-logic-update-conditional-tags at a WAF or reverse proxy, accepting that such a rule is a stopgap that does not fix the missing capability/nonce checks.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Share
External POC / Exploit Code
Leaving vuln.today