{"id":"CVE-2026-116852","kind":"vulnerability","aliases":["CVE-2026-116852"],"related":[],"title":"WordPress Widget Options plugin: author-level flaw allows remote code execution","description":"Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.","summary":"Widget Options, a WordPress plugin, has a remote code execution flaw in versions 4.2.5 and earlier. The sources do not say what an attacker must do first, but the outcome is running code on the server.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Widget Options plugin version in the WordPress admin plugin list, or in `wp-content/plugins/` on the server.","fix":"- Move to a version later than `4.2.5`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T19:18:15+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:25:45+00:00","updated_at":"2026-10-30T19:25:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:25:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `4.2.5`; the sources do not name the fixed version.","reach":"unknown","title":"WordPress Widget Options plugin: author-level flaw allows remote code execution","impact":"high","summary":"Widget Options, a WordPress plugin, has a remote code execution flaw in versions 4.2.5 and earlier. The sources do not say what an attacker must do first, but the outcome is running code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the WordPress server","analyst_note":"Confirm the fixed version and the required author-level access from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116852.","how_to_check":"- Check the installed Widget Options plugin version in the WordPress admin plugin list, or in `wp-content/plugins/` on the server.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Widget Options WordPress plugin at version 4.2.5 or earlier. The sources do not state which roles or settings are needed to trigger it, so treat any site running the plugin as exposed until the version is confirmed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000666,"input_tokens":4053,"output_tokens":521,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116852':15A,18A '-2026':14A,17A '4.2.5':37B,68C 'allow':9A 'attack':47B 'author':6A,60C 'author-level':5A 'code':11A,32B,56B,62C 'cve':13A,16A 'earlier':39B 'execut':12A,33B,63C 'first':50B 'flaw':8A,34B 'host':22B 'level':7A 'must':48B 'option':3A,25B,67C 'outcom':53B 'packag':19B 'plugin':4A,28B 'rce':64C 'remot':10A,31B,61C 'run':55B 'say':44B 'self':21B 'self-host':20B 'server':59B 'sourc':41B 'version':36B,69C 'widget':2A,24B,66C 'wordpress':1A,23B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Widget Options WordPress plugin at version 4.2.5 or earlier. The sources do not state which roles or settings are needed to trigger it, so treat any site running the plugin as exposed until the version is confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116852","severity":null,"published_at":"2026-10-30T19:18:15+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}