WordPress Widget Options Plugin OS Command Injection Vulnerability Allowing Arbitrary Code Execution

A command injection vulnerability has been identified in the WordPress Widget Options plugin, specifically in versions through 4.1.0. This vulnerability allows for operating system command injection, which could lead to arbitrary code execution on the affected site.

Impact

Exploitation of this vulnerability could allow a malicious actor to execute arbitrary code on the affected WordPress site, potentially leading to a complete takeover of the site.

Remediation

Users of the WordPress Widget Options plugin should update to version 4.1.1 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.