Executive brief
The Widget Context plugin for WordPress, which allows site owners to control where specific widgets appear on their website, is vulnerable to a security flaw. An attacker could trick a site administrator into clicking a malicious link, allowing the attacker to silently change widget visibility settings. This could lead to unauthorized changes in how the website displays information to visitors, potentially disrupting the site's layout or hiding important content.
Technical details
The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'save_widget_context_settings' function. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a link, which triggers a forged POST request to '/wp-admin/widgets.php'. Successful exploitation allows the attacker to modify widget visibility context settings stored in the WordPress options table. The vulnerability affects all versions up to and including 1.3.3; a fix was introduced in subsequent updates (referenced in pull request #73).
Affected products
- Kaspars Dambis Widget Context up to, and including, 1.3.3
Timeline
- 2026-05-18: patched: Fix merged in GitHub pull request #73
- 2026-05-22: disclosed: NVD publication date
References
- https://github.com/kasparsd/widget-context-wporg/pull/73
- https://plugins.trac.wordpress.org/browser/widget-context/tags/1.3.3/src/WidgetContext.php
- https://plugins.trac.wordpress.org/browser/widget-context/tags/1.3.3/src/WidgetContext.php
- https://plugins.trac.wordpress.org/browser/widget-context/tags/1.3.3/src/WidgetContext.php
- https://plugins.trac.wordpress.org/browser/widget-context/trunk/src/WidgetContext.php
- https://plugins.trac.wordpress.org/browser/widget-context/trunk/src/WidgetContext.php
- https://plugins.trac.wordpress.org/browser/widget-context/trunk/src/WidgetContext.php