Live › vulnerability › CVE-2026-116852
Widget Options, a WordPress plugin, has a remote code execution flaw in versions 4.2.5 and earlier. The sources do not say what an attacker must do first, but the outcome is running code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the Widget Options WordPress plugin at version 4.2.5 or earlier. The sources do not state which roles or settings are needed to trigger it, so treat any site running the plugin as exposed until the version is confirmed.
No product ranges from the sources yet.
wp-content/plugins/ on the server.4.2.5; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116852")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.