Widget Options WordPress Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress, affecting all versions through 4.2.2. The issue arises from the plugin's Display Logic feature, which improperly uses eval() to execute user-defined expressions. This creates a code injection risk, as the evaluation can be manipulated to execute arbitrary code on the server. The vulnerability is exploitable by authenticated users with Contributor-level access or higher.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user with Contributor-level access or higher can create a block or widget that uses the Display Logic feature. By crafting a specific logic expression that concatenates strings in a certain way, it's possible to inject malicious code that will be executed on the server.

Remediation

Users are advised to update the Widget Options plugin to version 4.2.3 or later, or to the extended version 5.3.3.