CVE-2026-2052
Remote Code Execution in Widget Options WordPress Plugin
Publication date: 2026-05-02
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| widget_options | widget_options | to 4.2.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress, affecting all versions up to and including 4.2.2. It allows Remote Code Execution through the Display Logic feature because the plugin uses the eval() function on user-supplied expressions without sufficient filtering. Attackers with Contributor-level access or higher can bypass the weak blocklist/allowlist by using array_map with string concatenation, and due to a lack of authorization enforcement on a specific attribute, they can execute arbitrary code on the server.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows authenticated users with relatively low privileges (Contributor-level) to execute arbitrary code on the server hosting the WordPress site. This can lead to full compromise of the server, including data theft, site defacement, installation of malware, or further attacks on the network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin to a version later than 4.2.2, as all versions up to and including 4.2.2 are vulnerable.
Note that the vulnerability was partially patched in version 4.2.0, but a full fix requires updating beyond 4.2.2.
Additionally, restrict Contributor-level access and above to trusted users only, as the vulnerability requires authenticated users with at least Contributor privileges.