CVE-2026-116852
CriticalCVSS 9.1Summary
The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.
Risk Assessment
A user with the author role could execute arbitrary code on the server, potentially leading to full site compromise.
Recommendation
Update the Widget Options plugin to a version newer than 4.2.5 or restrict author privileges until the fix is applied.
Other vulnerabilities in Widget Options
See all- CVE-2026-54823Critical
There is a remote code execution (RCE) vulnerability in Widget Options versions <= 4.2.3 that can be exploited by an attacker.
- CVE-2025-10580Medium
The Widget Options – The #1 WordPress Widget & Block Control Plugin is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.
Original NVD description (English source)
Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS