Remote Code Execution Risk in Widget Options Plugin

WordPress

What happened

A vulnerability has been identified that allows for remote code execution in the Widget Options plugin versions 4.2.5 and earlier.

Are you affected?

Users of the Widget Options plugin may be affected if they are running versions 4.2.5 or earlier.

What to do now

1. Consider upgrading to a patched version or checking the official advisory for further actions.
2. Monitor your system for any unusual activity in case of exploitation.
3. Review and apply any recommended security practices specific to your environment.

Sources

• cve.now/CVE-2026-116852
• cve.now/GHSA-pqqr-8pmv-5qrf
• CVE-2026-116852
• GHSA-pqqr-8pmv-5qrf
• https://nvd.nist.gov/vuln/detail/CVE-2026-116852
• https://patchstack.com/database/wordpress/plugin/widget-options/vulnerability/wordpress-widget-options-plugin-4-2-5-remote-code-execution-rce-vulnerability?_s_id=cve
• cve.now/GHSA-PQQR-8PMV-5QRF
• GHSA-PQQR-8PMV-5QRF

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.