Executive brief
The Widget Logic Visual plugin for WordPress, which allows administrators to control where website widgets appear, contains a security flaw that allows low-level users to run malicious code on the server. By exploiting this vulnerability, an attacker with a basic account (such as a subscriber) can take full control of the website, access sensitive data, or disrupt operations. This issue affects all versions of the plugin up to and including 1.52.
Technical details
The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution (RCE) due to a combination of security failures in the widget-logic-update-conditional-tags AJAX action. Specifically, the 'widget_logic_visual_check_visibility' function lacks proper capability checks and nonce verification, allowing any authenticated user (including those with Subscriber roles) to trigger the action. Furthermore, the 'nwlv[cod-tag]' parameter is insufficiently sanitized before being stored and subsequently executed via an eval() call. An attacker can leverage this to inject and execute arbitrary PHP code on the underlying server. The vulnerability is present in all versions up to and including 1.52.
Affected products
- totalbounty Widget Logic Visual up to, and including, 1.52
Timeline
- 2026-07-08: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/widget-logic-visual/trunk/ajax.php
- https://plugins.trac.wordpress.org/browser/widget-logic-visual/trunk/ajax.php
- https://plugins.trac.wordpress.org/browser/widget-logic-visual/trunk/custom.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5d82e9e2-c572-4911-a6a5-1384844214b0?source=cve