Code Injection Vulnerability in Marketing Fire Widget Options Plugin by WordPress
CVE-2026-27984

9CRITICAL

Key Information:

Vendor

WordPress
Status
Widget Options
Vendor
CVE Published:
5 March 2026

What is CVE-2026-27984?

The Marketing Fire Widget Options plugin is vulnerable to code injection, allowing an attacker to execute arbitrary code through compromised user input. This issue primarily affects versions of Widget Options up to and including 4.1.3, posing a significant risk to WordPress sites utilizing this plugin. It is essential to review and update to secure versions to mitigate potential exploitation.

Affected Version(s)

Widget Options 0 <= 4.1.3

References

https://patchstack.com/database/Wordpress/Plugin/widget-o...
vdb-entry

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mcdruid | Patchstack Bug Bounty Program
.