Widget Options
Monthly
Remote code execution in the WordPress Widget Options plugin through version 4.2.5 allows authenticated attackers to inject and execute code on vulnerable sites, with the supplied CVSS vector indicating high privileges while the advisory title indicates an Author-level account may suffice. The flaw is network-reachable, low-complexity, requires no user interaction, and is scope-changing with high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified in the supplied data; the vuln.today decision label is act_now, so prioritize confirming the exact required role and applying a fix or removing the plugin.
Code injection in the Widget Options WordPress plugin (versions <= 4.2.3, by marketingfire) allows authenticated users holding the low-privileged Contributor role to achieve remote code execution on the host. Because exploitation only requires a Contributor account - a role frequently granted on multi-author and membership sites - an attacker who can register or compromise such an account can run arbitrary PHP and fully take over the site. There is no public exploit identified at time of analysis, but the 9.9 CVSS and CWE-94 classification place this at the most severe end of WordPress plugin flaws.
Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data.0.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in the WordPress Widget Options plugin through version 4.2.5 allows authenticated attackers to inject and execute code on vulnerable sites, with the supplied CVSS vector indicating high privileges while the advisory title indicates an Author-level account may suffice. The flaw is network-reachable, low-complexity, requires no user interaction, and is scope-changing with high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified in the supplied data; the vuln.today decision label is act_now, so prioritize confirming the exact required role and applying a fix or removing the plugin.
Code injection in the Widget Options WordPress plugin (versions <= 4.2.3, by marketingfire) allows authenticated users holding the low-privileged Contributor role to achieve remote code execution on the host. Because exploitation only requires a Contributor account - a role frequently granted on multi-author and membership sites - an attacker who can register or compromise such an account can run arbitrary PHP and fully take over the site. There is no public exploit identified at time of analysis, but the 9.9 CVSS and CWE-94 classification place this at the most severe end of WordPress plugin flaws.
Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data.0.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.