CVE-2026-116615

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the post_content parameter. This is due to asymmetric parsing between the save-time strip filter (widgetopts_strip_logic_from_blocks()) and the render-time parser (blockopts_filter_before_display()): embedding an inner <!--start_widgetopts literal inside a JSON key causes the write-side json_decode to see a non-class key and skip stripping — persisting the payload verbatim to the database — while the render-side str_replace reconstitutes the key to class, feeding the attacker-controlled logic value directly into @eval. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary get_option, get_user_meta, and get_post_meta values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the widgetopts_allowed_php_functions filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes widgetopts_safe_eval_trusted() to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above.

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the post_content parameter. This is due to asymmetric parsing between the save-time strip filter (widgetopts_strip_logic_from_blocks()) and the render-time parser (blockopts_filter_before_display()): embedding an inner <!--start_widgetopts literal inside a JSON key causes the write-side json_decode to see a non-class key and skip stripping — persisting the payload verbatim to the database — while the render-side str_replace reconstitutes the key to class, feeding the attacker-controlled logic value directly into @eval. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary get_option, get_user_meta, and get_post_meta values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the widgetopts_allowed_php_functions filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes widgetopts_safe_eval_trusted() to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above.

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the post_content parameter. This is due to asymmetric parsing between the save-time strip filter (widgetopts_strip_logic_from_blocks()) and the render-time parser (blockopts_filter_before_display()): embedding an inner <!--start_widgetopts literal inside a JSON key causes the write-side json_decode to see a non-class key and skip stripping — persisting the payload verbatim to the database — while the render-side str_replace reconstitutes the key to class, feeding the attacker-controlled logic value directly into @eval. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary get_option, get_user_meta, and get_post_meta values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the widgetopts_allowed_php_functions filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes widgetopts_safe_eval_trusted() to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above.

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the post_content parameter. This is due to asymmetric parsing between the save-time strip filter (widgetopts_strip_logic_from_blocks()) and the render-time parser (blockopts_filter_before_display()): embedding an inner <!--start_widgetopts literal inside a JSON key causes the write-side json_decode to see a non-class key and skip stripping — persisting the payload verbatim to the database — while the render-side str_replace reconstitutes the key to class, feeding the attacker-controlled logic value directly into @eval. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary get_option, get_user_meta, and get_post_meta values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the widgetopts_allowed_php_functions filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes widgetopts_safe_eval_trusted() to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above.