CVE-2026-116852

Summary

A remote code execution (RCE) vulnerability exists in Widget Options plugin versions <= 4.2.5 due to improper input validation (CWE-94), allowing authenticated authors to inject and execute arbitrary PHP code.

Exploitability

Exploitation requires high-privilege access (author role or higher) with no user interaction, making it difficult for unauthenticated attackers but serious for compromised or insider threats.

Blast radius

Successful exploitation could lead to full system compromise including data theft, backdoor installation, and lateral movement within the WordPress environment.

Detection

Look for suspicious PHP code execution in web server logs (e.g., POST requests to /wp-admin/admin-ajax.php with base64-encoded payloads or eval() calls) and unexpected file creation/modification under wp-content/uploads/ by author-level users.

Prioritized remediation

Upgrade to Widget Options version 4.2.6 or later, which contains the official patch for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.