# Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.5 - Authenticated (Contributor+) Remote Code Execution via SiteOrigin Page Builder Display Logic

- **ID:** WPSEC-2026-1715
- **Plugin:** Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets (`widget-options`), https://wordpress.org/plugins/widget-options/
- **Affected versions:** all versions before 4.2.6
- **Fixed in:** 4.2.6 (Update to 4.2.6 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/widget-options
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1715/

## Description

The Widget Options plugin for WordPress is vulnerable to Remote Code Execution via the legacy display logic stored in SiteOrigin Page Builder panels data in all versions up to, and including, 4.2.5. This is due to the plugin only checking for injected display logic ('class.logic') when the panels_data post meta is updated, not when it is newly added. Non-administrators can therefore store logic code that the plugin later passes to eval() when the page is rendered. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server when the SiteOrigin Page Builder integration and the Display Logic module are in use.

## References

- https://wpsec.com/vuln/WPSEC-2026-1715/
- https://plugins.svn.wordpress.org/widget-options/tags/4.2.6/
- https://wordpress.org/plugins/widget-options/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1715/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.