What the vulnerability does
01Description
The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.7 via the display logic functionality that extends several page builders. This is due to the plugin allowing users to supply input that will be passed through eval() without any filtering or capability checks. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. Special note: We suggested the vendor implement an allowlist of functions and limit the ability to execute commands to just administrators, however, they did not take our advice. We are considering this patched, however, we believe it could still be further hardened and there may be residual risk with how the issue is currently patched.
Explanation of Vulnerability in Simple Terms
02Summary
An attacker with low-level site access can inject and execute arbitrary PHP code through the Widget Options plugin. The vulnerability affects all versions up to 4.0.7. An attacker can run their own code on the site, potentially compromising the entire WordPress installation, stealing data, or modifying content. Site owners must update immediately to a version newer than 4.0.7.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with full site privileges.
Potential impact on your site
04Site Impact
Complete site compromise possible; attacker can steal data, modify content, create admin accounts, or inject malware.
Conditions required to exploit
05Prerequisites
Attacker needs a low-privilege account (subscriber or contributor level) on the WordPress site.
Key dates
06Disclosure timeline
November 28, 2024
CVE published
April 8, 2026
Record updated
