PT-2026-56310 · Totalbounty · Widget Logic Visual

Nabil Irawan · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-14158

Mitre

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget logic visual check visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequent use in an eval() call. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-14158

Affected Products

Widget Logic Visual

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-14158 · Security Note
• https://plugins.trac.wordpress.org/browser/widget-logic-visual/trunk/custom.php#L50 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5d82e9e2-c572-4911-a6a5-1384844214b0?source=cve · Note
• https://plugins.trac.wordpress.org/browser/widget-logic-visual/trunk/ajax.php#L91 · Note
• https://plugins.trac.wordpress.org/browser/widget-logic-visual/trunk/ajax.php#L14 · Note