Command Injection Vulnerability in MarketingFire Widget Options
CVE-2025-22630

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Widget Options
Vendor
CVE Published:
14 February 2025

What is CVE-2025-22630?

A command injection vulnerability exists in the MarketingFire Widget Options plugin that allows attackers to execute arbitrary operating system commands through improper handling of special elements. This flaw can pose serious security risks, enabling unauthorized access and manipulation of the underlying system. The issue affects versions of Widget Options up to and including 4.1.0, highlighting the need for prompt updates to safeguard your WordPress installations.

Affected Version(s)

Widget Options <= 4.1.0

References

https://patchstack.com/database/wordpress/plugin/widget-o...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT)
.