{"id":"CVE-2026-116615","kind":"vulnerability","aliases":["CVE-2026-116615"],"related":[],"title":"Widget Options WordPress plugin: logic injection lets authors run PHP","description":"The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing between the save-time strip filter (`widgetopts_strip_logic_from_blocks()`) and the render-time parser (`blockopts_filter_before_display()`): embedding an inner `<!--start_widgetopts` literal inside a JSON key causes the write-side `json_decode` to see a non-`class` key and skip stripping — persisting the payload verbatim to the database — while the render-side `str_replace` reconstitutes the key to `class`, feeding the attacker-controlled `logic` value directly into `@eval`. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary `get_option`, `get_user_meta`, and `get_post_meta` values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the `widgetopts_allowed_php_functions` filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes `widgetopts_safe_eval_trusted()` to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above.","summary":"The Widget Options plugin for WordPress, in all versions up to and including 4.2.6.1, lets a user with Author access inject PHP expressions through the post_content parameter. The injected code runs on every front-end page view, can read site configuration such as the admin email and user and post metadata, and can run for unauthenticated visitors when a contributor's post is published by an administrator.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Widget Options","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","widget-options","wordpress","wordpress-plugin"],"not_affected_if":["no-author-accounts","plugin-not-installed"],"how_to_check":"- Check the installed Widget Options version under Plugins in the WordPress admin; versions `4.2.6.1` and earlier are affected.\n- Check whether any contributor or author posts were published by an administrator or editor after a contributor submitted them, since that path also exposes visitors.","fix":null,"status":"open","published_at":"2026-11-13T10:17:25+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","triaged_at":"2026-11-13T10:49:16+00:00","updated_at":"2026-11-13T10:49:16+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-13T10:49:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Widget Options WordPress plugin: logic injection lets authors run PHP","impact":"high","summary":"The Widget Options plugin for WordPress, in all versions up to and including 4.2.6.1, lets a user with Author access inject PHP expressions through the post_content parameter. The injected code runs on every front-end page view, can read site configuration such as the admin email and user and post metadata, and can run for unauthenticated visitors when a contributor's post is published by an administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","widget-options","self-hosted"],"confidence":0.75,"fix_status":"unknown","needs_auth":"yes","worst_case":"Injected PHP runs for every visitor; site configuration readable","analyst_note":"","how_to_check":"- Check the installed Widget Options version under Plugins in the WordPress admin; versions `4.2.6.1` and earlier are affected.\n- Check whether any contributor or author posts were published by an administrator or editor after a contributor submitted them, since that path also exposes visitors.","plain_action":"","product_name":"Widget Options","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-author-accounts"],"who_is_affected":"Sites running the Widget Options plugin at version 4.2.6.1 or earlier are exposed. An attacker needs an account with Author access or above; contributors can also exploit it when an administrator or editor publishes their submitted post. On a default installation without that publishing setup, Author access or above is required, and sites without the plugin can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001778,"input_tokens":5103,"output_tokens":2536,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116615':13A,16A '-2026':12A,15A '4.2.6':331C '4.2.6.1':43B,125C 'access':49B,225C,358C,390C 'address':254C 'admin':76B,252C,342C 'administr':98B,309C,364C 'advanc':102C 'allow':290C 'allowlist':274C 'allowlisted-funct':273C 'also':296C 'arbitrari':258C 'asymmetr':135C 'attack':207C,220C,353C,385C 'attacker-control':206C 'authent':219C 'author':8A,48B,223C,388C 'author-level':222C,387C 'block':107C,148C 'blockopt':155C 'boolean':243C 'boolean-oracl':242C 'bypass':338C 'callsit':350C 'caus':169C,332C 'circuit':345C 'class':180C,203C 'classic':108C 'code':60B,116C,281C 'condit':103C 'configur':72B,249C,381C 'content':56B,129C 'contributor':91B,294C,356C,370C 'contributor-level':355C 'control':208C 'cve':11A,14A 'data':250C 'databas':191C 'decod':175C 'default':255C,375C 'direct':211C 'display':158C 'due':133C 'editor':366C 'email':77B,253C 'embed':159C 'enabl':241C 'end':66B,238C 'escal':278C 'eval':213C,335C 'everi':63B,235C,347C 'execut':233C,282C,314C 'exfiltr':245C 'exploit':297C,351C 'express':52B,231C 'extend':287C 'feed':204C 'filter':143C,156C,293C 'flag':326C 'front':65B,237C 'front-end':64B,236C 'function':275C,292C 'get':259C,261C,265C 'gutenberg':106C 'host':22B 'includ':42B,124C,251C,319C 'inject':6A,50B,59B,117C,229C,312C 'inner':161C 'insid':165C 'instal':285C,376C 'introduc':328C 'json':167C,174C 'key':168C,181C,201C 'later':305C,367C 'legaci':348C 'let':7A,44B 'level':224C,357C,389C 'liter':164C 'logic':5A,146C,209C 'make':215C 'mechan':327C 'meta':263C,267C 'metadata':82B 'non':179C,341C 'non-admin':340C 'notabl':310C 'option':2A,25B,32B,101C,260C 'options':18A 'oracl':244C 'packag':19B 'page':67B,239C 'paramet':57B,130C 'pars':136C 'parser':154C 'payload':187C,313C 'persist':185C 'php':10A,51B,230C,291C 'plugin':4A,29B,33B,110C,271C,286C 'possibl':217C 'post':55B,81B,93B,128C,266C,303C 'publish':95B,306C,368C 'read':70B 'reconstitut':199C 'render':152C,195C,349C 'render-sid':194C 'render-tim':151C 'replac':198C 'requir':361C,384C 'role':256C 'run':9A,61B,85B 'safe':334C 'sandbox':276C 'save':140C 'save-tim':139C 'see':177C 'self':21B 'self-host':20B 'short':344C 'short-circuit':343C 'side':173C,196C 'site':71B,248C,317C 'skip':183C 'start':162C 'str':197C 'strip':142C,145C,184C 'submiss':372C 'submit':302C 'time':141C,153C 'trust':325C,336C 'trust-flag':324C 'unauthent':87B,320C 'unrestrict':280C 'user':46B,79B,262C,321C 'valu':210C,268C 'verbatim':188C 'version':38B,120C,330C 'via':126C,269C 'view':68B,240C 'visibl':104C 'visitor':88B,318C 'vulner':114C,299C,383C 'widget':1A,17A,24B,31B,100C,109C 'widget-opt':23B 'widgetopt':144C,163C,289C,333C 'wordpress':3A,26B,28B,35B,112C,247C 'wordpress-plugin':27B 'write':172C 'write-sid':171C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Widget Options plugin at version 4.2.6.1 or earlier are exposed. An attacker needs an account with Author access or above; contributors can also exploit it when an administrator or editor publishes their submitted post. On a default installation without that publishing setup, Author access or above is required, and sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["options","widgetoptions"],"ptokens":["options","widget"],"labels":["high","package","selfhosted","vendor","widgetoptions","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-116615':13A,16A '-2026':12A,15A 'author':8A 'cve':11A,14A 'inject':6A 'let':7A 'logic':5A 'option':2A 'options':18A 'php':10A 'plugin':4A 'run':9A 'widget':1A,17A 'wordpress':3A","search_b":"'4.2.6.1':43B 'access':49B 'admin':76B 'administr':98B 'author':48B 'code':60B 'configur':72B 'content':56B 'contributor':91B 'email':77B 'end':66B 'everi':63B 'express':52B 'front':65B 'front-end':64B 'host':22B 'includ':42B 'inject':50B,59B 'let':44B 'metadata':82B 'option':25B,32B 'packag':19B 'page':67B 'paramet':57B 'php':51B 'plugin':29B,33B 'post':55B,81B,93B 'publish':95B 'read':70B 'run':61B,85B 'self':21B 'self-host':20B 'site':71B 'unauthent':87B 'user':46B,79B 'version':38B 'view':68B 'visitor':88B 'widget':24B,31B 'widget-opt':23B 'wordpress':26B,28B,35B 'wordpress-plugin':27B","search_c":"'4.2.6':331C '4.2.6.1':125C 'access':225C,358C,390C 'address':254C 'admin':252C,342C 'administr':309C,364C 'advanc':102C 'allow':290C 'allowlist':274C 'allowlisted-funct':273C 'also':296C 'arbitrari':258C 'asymmetr':135C 'attack':207C,220C,353C,385C 'attacker-control':206C 'authent':219C 'author':223C,388C 'author-level':222C,387C 'block':107C,148C 'blockopt':155C 'boolean':243C 'boolean-oracl':242C 'bypass':338C 'callsit':350C 'caus':169C,332C 'circuit':345C 'class':180C,203C 'classic':108C 'code':116C,281C 'condit':103C 'configur':249C,381C 'content':129C 'contributor':294C,356C,370C 'contributor-level':355C 'control':208C 'data':250C 'databas':191C 'decod':175C 'default':255C,375C 'direct':211C 'display':158C 'due':133C 'editor':366C 'email':253C 'embed':159C 'enabl':241C 'end':238C 'escal':278C 'eval':213C,335C 'everi':235C,347C 'execut':233C,282C,314C 'exfiltr':245C 'exploit':297C,351C 'express':231C 'extend':287C 'feed':204C 'filter':143C,156C,293C 'flag':326C 'front':237C 'front-end':236C 'function':275C,292C 'get':259C,261C,265C 'gutenberg':106C 'includ':124C,251C,319C 'inject':117C,229C,312C 'inner':161C 'insid':165C 'instal':285C,376C 'introduc':328C 'json':167C,174C 'key':168C,181C,201C 'later':305C,367C 'legaci':348C 'level':224C,357C,389C 'liter':164C 'logic':146C,209C 'make':215C 'mechan':327C 'meta':263C,267C 'non':179C,341C 'non-admin':340C 'notabl':310C 'option':101C,260C 'oracl':244C 'page':239C 'paramet':130C 'pars':136C 'parser':154C 'payload':187C,313C 'persist':185C 'php':230C,291C 'plugin':110C,271C,286C 'possibl':217C 'post':128C,266C,303C 'publish':306C,368C 'reconstitut':199C 'render':152C,195C,349C 'render-sid':194C 'render-tim':151C 'replac':198C 'requir':361C,384C 'role':256C 'safe':334C 'sandbox':276C 'save':140C 'save-tim':139C 'see':177C 'short':344C 'short-circuit':343C 'side':173C,196C 'site':248C,317C 'skip':183C 'start':162C 'str':197C 'strip':142C,145C,184C 'submiss':372C 'submit':302C 'time':141C,153C 'trust':325C,336C 'trust-flag':324C 'unauthent':320C 'unrestrict':280C 'user':262C,321C 'valu':210C,268C 'verbatim':188C 'version':120C,330C 'via':126C,269C 'view':240C 'visibl':104C 'visitor':318C 'vulner':114C,299C,383C 'widget':100C,109C 'widgetopt':144C,163C,289C,333C 'wordpress':112C,247C 'write':172C 'write-sid':171C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116615","severity":null,"published_at":"2026-11-13T10:17:25+00:00","modified_at":"2026-11-13T10:17:26+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","fetched_at":"2026-11-13T10:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}