Vulnerability · Published Nov 28, 2024 · Assigned by Wordfence

CVE-2024-8672Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution

Critical 9.9

In plain English

A critical-severity code injection in Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets from marketingfire. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 45.4% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)45.4%top 1.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.7 via the display logic functionality that extends several page builders. This is due to the plugin allowing users to supply input that will be passed through eval() without any filtering or capability checks. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. Special note: We suggested the vendor implement an allowlist of functions and limit the ability to execute commands to just administrators, however, they did not take our advice. We are considering this patched, however, we believe it could still be further hardened and there may be residual risk with how the issue is currently patched.

Affected products (as reported)

Vendor	Product	Versions
marketingfire	Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets	0 – through 4.0.7

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References