CVE-2026-2052

{
  "id": "CVE-2026-2052",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-02T08:16:27.123",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0."
    },
    {
      "lang": "es",
      "value": "El plugin Widget Options - Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets para WordPress es vulnerable a ejecución remota de código en todas las versiones hasta, e incluyendo, la 4.2.2 a través de la característica Display Logic. Esto se debe a que el plugin utiliza eval() en expresiones Display Logic proporcionadas por el usuario con una blocklist/allowlist insuficiente que puede ser evitada usando array_map con concatenación de cadenas, combinado con una falta de aplicación de autorización en el atributo extended_widget_opts_block. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, ejecuten código en el servidor. La vulnerabilidad fue parcialmente parcheada en la versión 4.2.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "marketingfire",
          "product": "Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "4.2.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Marketing Fire, LLC",
          "product": "Widget Options - Extended",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "5.3.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-04T16:19:28.183916Z",
          "id": "CVE-2026-2052",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L495",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L534",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php#L843",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/3481338/",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/3514411/",
      "source": "[email protected]"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=cve",
      "source": "[email protected]"
    }
  ]
}