Executive brief
Widget Options is a popular WordPress plugin used to manage and customize how widgets appear on a website. A critical security flaw allows users with 'Contributor' level access to execute arbitrary code on the server. This could lead to a complete takeover of the website, unauthorized data access, or the installation of persistent backdoors.
Technical details
The Widget Options plugin for WordPress (versions 4.2.3 and below) is vulnerable to Remote Code Execution (RCE) due to improper control of generation of code (CWE-94). The vulnerability allows an authenticated attacker with 'Contributor' level permissions or higher to inject and execute arbitrary PHP code on the server. This occurs because the plugin fails to properly sanitize or restrict inputs that influence code execution paths within the widget management logic. An exploit can lead to full site compromise and lateral movement within the hosting environment. The issue is resolved in version 4.2.4.
Affected products
- MarketingFire Widget Options <= 4.2.3
Timeline
- 2026-04-27: other: Vulnerability reported by researcher daroo
- 2026-06-17: advisory: Patchstack published advisory
- 2026-06-25: disclosed: NVD publication date
- 2026-06-25: patched: Version 4.2.4 confirmed as patched version