WordPress Plugin Vulnerabilities

Widget Options <= 4.1.3 - Contributor+ Remote Code Execution

Description

The plugin is vulnerable to Remote Code Execution. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Affects Plugins

Plugin icon
widget-options
No known fix

References

CVE
CVE-2026-27984
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/664eb488-649e-4914-bd3c-cb7395893c6f

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Drew Webber (mcdruid)
Verified
No
WPVDB ID
2b5919a6-bb6d-4cf1-b6ef-cd17a3b818d6

Timeline

Publicly Published
2026-03-02 (about 1 month ago)
Added
2026-03-12 (about 23 days ago)
Last Updated
2026-03-12 (about 23 days ago)

Other

Published
Title
Published
2022-07-01
Title
WP All Import < 3.6.8 - Admin+ Arbitrary File Upload
Published
2025-03-26
Title
PDF for WPForms < 5.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
Published
2021-02-22
Title
QuadMenu < 2.0.7 - Unauthenticated RCE via compiler_save
Published
2026-03-19
Title
YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation
Published
2026-02-24
Title
W3 Total Cache < 2.9.2 - Unauthenticated Arbitrary Code Execution