Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.5 - Authenticated (Contributor+) Remote Code Execution via SiteOrigin Page Builder Display Logic
- ID
- WPSEC-2026-1715
- Plugin
- Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets (widget-options)
- Affected
- all versions before 4.2.6
- Remediation
- Update to 4.2.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets on WPSec AttackSurface
- Fix released
- Published
Description
The Widget Options plugin for WordPress is vulnerable to Remote Code Execution via the legacy display logic stored in SiteOrigin Page Builder panels data in all versions up to, and including, 4.2.5. This is due to the plugin only checking for injected display logic ('class.logic') when the panels_data post meta is updated, not when it is newly added. Non-administrators can therefore store logic code that the plugin later passes to eval() when the page is rendered. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server when the SiteOrigin Page Builder integration and the Display Logic module are in use.
References
- https://wpsec.com/vuln/WPSEC-2026-1715/
- https://plugins.svn.wordpress.org/widget-options/tags/4.2.6/
- https://wordpress.org/plugins/widget-options/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS