Code Injection Vulnerability in Widget Options Plugin for WordPress

CVE-2026-116615

What is CVE-2026-116615?

The Widget Options plugin for WordPress is susceptible to a code injection vulnerability that is present in all versions up to and including 4.2.6.1. This vulnerability arises from a discrepancy in the parsing logic between the save-time filter and the render-time parser, which allows attackers with Author-level access and above to inject malicious PHP expressions. These expressions execute on every front-end page view, giving authenticated attackers the ability to exfiltrate sensitive site configuration data through a compromised plugin sandbox. Notably, attackers can also escalate their privileges if other plugins interact with the abuse-prone widgetopts_allowed_php_functions filter, thereby permitting unrestricted code execution. This poses a significant risk, especially since contributors can exploit this vulnerability with the potential for their malicious payloads to execute after their submissions are published by an administrator.

References