Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Marketing Fire | Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets | up to 4.2.2 | — | No fix listed | CNA |
| Marketing Fire | Widget Options - Extended | up to 5.3.2 | — | No fix listed | CNA |
- Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets VendorMarketing Fire Affected up to 4.2.2 Fixed in — No fix listed CNA
- Widget Options - Extended VendorMarketing Fire Affected up to 5.3.2 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2052
- 2026-10-03 Alias added: GHSA-g2qq-qv5m-hcgq
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=cve
- https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php#L843
- https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L495
- https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L534
- https://plugins.trac.wordpress.org/changeset/3481338/
- https://plugins.trac.wordpress.org/changeset/3514411/
More Marketing Fire vulnerabilities
- TI-2024-08045 Code injection in Marketing Fire Widget Options – Advanced Conditional Visibility for… CVSS 3.1CRITICAL 9.9
- TI-2025-16513 WordPress Widget Options Plugin <= 4.1.0 - Arbitrary Code Execution vulnerability CVSS 3.1CRITICAL 9.9
- TI-2026-39626 WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.9
- TI-2026-83311 Remote code execution in WordPress Widget Options plugin CVSS 3.1CRITICAL 9.1
- TI-2026-22326 WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.0
- TI-2025-29007 WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Settings Change vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2026-2052 · CVE Program
- CVE-2026-2052 · NVD
- FIRST EPSS
- GHSA-g2qq-qv5m-hcgq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences