Remote Code Execution in Widget Options Plugin for WordPress
CVE-2026-2052
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 2 May 2026
What is CVE-2026-2052?
The Widget Options plugin for WordPress, specifically the Advanced Conditional Visibility feature, is susceptible to Remote Code Execution due to improper handling of user-supplied Display Logic expressions. Versions up to 4.2.2 utilize eval() without sufficient validation, allowing authenticated attackers with Contributor-level permissions or higher to execute arbitrary code on the server. This vulnerability arises from inadequate filtering in the blocklist/allowlist and insufficient authorization checks on certain attributes. Although it was partially addressed in version 4.2.0, users are encouraged to verify their installations and apply recommended updates to ensure security.
Affected Version(s)
Widget Options - Extended 0 <= 5.3.2
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets 0 <= 4.2.2