PT-2024-9156 · WordPress · The Widget Options

Craig Smith

+1

·

Published

2024-11-27

·

Updated

2025-03-21

·

CVE-2024-8672

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: The Widget Options – The #1 WordPress Widget & Block Control Plugin versions up to, and including, 4.0.7
Description: The issue is related to the eval() function in the plugin, which allows users to supply input that will be passed through without any filtering or capability checks. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. The vulnerability is due to the plugin's display logic functionality that extends several page builders. It is estimated that over 100,000 websites using the plugin are potentially affected.
Recommendations: For versions up to, and including, 4.0.7, update to version 4.0.8 immediately to resolve the issue. As a temporary workaround, consider restricting access to the display logic functionality to minimize the risk of exploitation. Additionally, limiting the ability to execute commands to just administrators can help mitigate the risk.

Exploit

Fix

RCE

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2024-10843
CVE-2024-8672

Affected Products

The Widget Options