Widget Options < 4.2.3 - Contributor+ Remote Code Execution via Display Logic

Description

The plugin is vulnerable to Remote Code Execution via the Display Logic feature due to the use of eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers with Contributor-level access and above to execute code on the server. The vulnerability was partially patched in version 4.2.0.