Widget Options WordPress plugin: logic injection lets authors run PHP

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the post_content parameter. This is due to asymmetric parsing between the save-time strip filter (widgetopts_strip_logic_from_blocks()) and the render-time parser (blockopts_filter_before_display()): embedding an inner <!--start_widgetopts literal inside a JSON key causes the write-side json_decode to see a non-class key and skip stripping — persisting the payload verbatim to the database — while the render-side str_replace reconstitutes the key to class, feeding the attacker-controlled logic value directly into @eval. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary get_option, , and values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above.