WordPress Widget Options: Remote Code Execution

Summary

The WordPress plugin Widget Options by Marketing Fire up to and including version 4.2.5 contains a flaw that allows remote code execution. According to the CNA Patchstack, an attacker with Author rights can run arbitrary commands on the server. Patchstack expects mass exploitation, but NVD has not yet analysed the CVE and VulDB rates it only as medium (6.3).

Affected

• Widget Options WordPress plugin (Marketing Fire), all versions up to and including 4.2.5

Fixed in

• Update to version 4.2.6 or later (CNA and Patchstack)

Workaround

• No vendor workaround confirmed.
• Deactivate the plugin if the display-logic feature is not needed.
• Review accounts with Author rights or higher and remove unused ones.
• Restrict XML-RPC if it is not used.

Exploitation

• Not known to be exploited; the CISA SSVC assessment lists exploitation as none.
• No public exploit code indexed in Metasploit or Exploit-DB.
• Patchstack describes the vulnerability as highly dangerous and expects exploitation.

Our recommendation

• Check whether the plugin is installed and which version is running.
• Update to version 4.2.6 or later immediately.
• If an update is not possible, deactivate the plugin.
• Review Author and higher accounts and monitor logs for unusual activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Strix CVE-2026-116852 www.strix.ai
• VulDB 429307 vuldb.com
• OffSeq threat radar CVE-2026-116852 radar.offseq.com
• WordPress Widget Options plugin page (WPScan) wpscan.com
• GitHub issue #148 Widget Options github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:06.