PT-2026-36588 · Marketing Fire · Widget Options - Extended+1

Hung Nguyen + 1 · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-2052

Mitre

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array map with string concatenation, combined with a lack of authorization enforcement on the extended widget opts block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-2052

Affected Products

Widget Options - Extended

Widget Options – Advanced Conditional Visibility For Gutenberg Blocks & Classic Widgets

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2052 · Security Note
• https://plugins.trac.wordpress.org/changeset/3514411 · Note
• https://plugins.trac.wordpress.org/changeset/3481338 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L534 · Note
• https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php#L843 · Note
• https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L495 · Note