An improper code generation flaw in the Widget Options plugin for WordPress allows authenticated attackers with Contributor-level access to execute arbitrary code, leading to total system compromise.

This vulnerability is a Code Injection flaw (CWE-94) caused by the insecure use of eval() on user-supplied Display Logic expressions with an insufficient blocklist, combined with a lack of authorization enforcement. The flaw can be exploited by an authenticated attacker with Contributor-level access.

A successful exploit of this vulnerability grants attackers full control over the underlying WordPress server, leading to potential data theft, malware distribution, and complete site disruption. Given the high CVSS score of 8.8, the business impact is severe, risking unauthorized administrative access, severe reputational damage, and extended operational downtime if the application is compromised.

Immediate Action: Update the Widget Options plugin to the latest version addressing the vulnerability, or deactivate the plugin immediately if an official patch is unavailable.

Proactive Monitoring: Monitor server logs for suspicious file modifications, unexpected process executions, and unusual activity originating from accounts with Contributor-level privileges.

Compensating Controls: Deploy a Web Application Firewall to inspect HTTP requests for malicious payload injection attempts targeting the Display Logic feature.

Public Exploit Available: No

Security teams must treat this vulnerability with high urgency due to the potential for remote code execution. Administrators should apply the latest available vendor updates immediately and review user role assignments to ensure that untrusted accounts do not possess unnecessary privileges.