Remote Code Execution in Widget Options by Widget Options Plugin
CVE-2026-116852

9.1CRITICAL

Key Information:

Vendor

WordPress
Status
Widget Options
Vendor
CVE Published:
30 October 2026

What is CVE-2026-116852?

The Widget Options plugin for WordPress is susceptible to a Remote Code Execution (RCE) vulnerability that affects versions 4.2.5 and earlier. This flaw allows an attacker to execute arbitrary code on affected sites, potentially compromising the security and integrity of the server. Website owners using this plugin should take immediate action to update their installations to mitigate the risk of exploitation. For detailed information and protective measures, refer to the security advisory.

Affected Version(s)

Widget Options <= 4.2.5

References

https://patchstack.com/database/wordpress/plugin/widget-o...
vdb-entry

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sanghyeok Kim (Hamoyeah) | Patchstack Bug Bounty Program
.