CVE-2026-116615

Name of the Vulnerable Software and Affected Versions Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets versions prior to 4.2.6.2

Description Code injection is possible via the post content parameter due to asymmetric parsing between the save-time strip filter (widgetopts strip logic from blocks()) and the render-time parser (blockopts filter before display()). By embedding an inner <!--start widgetopts literal inside a JSON key, the json decode function on the write-side fails to identify the class key and skips stripping, allowing the payload to be stored in the database. During rendering, str replace reconstitutes the key to class, passing the attacker-controlled logic value into @eval. Authenticated attackers with Author-level access or higher can inject PHP expressions that execute on every front-end page view. This allows for boolean-oracle exfiltration of site configuration data, such as admin email addresses and default roles, using get option, get user meta, and get post meta. This can escalate to unrestricted code execution if any installed plugin extends the widgetopts allowed php functions filter. Additionally, Contributors can exploit this if an administrator publishes their submission. The payload executes for all visitors, including unauthenticated users, because a trust-flag mechanism in version 4.2.6 causes widgetopts safe eval trusted() to bypass its non-admin short-circuit.

Recommendations Update Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets to version 4.2.6.2 or later.