CVE-2024-8672

CVE-2024-8672 is a code-injection flaw (CWE-94) in the Widget Options WordPress plugin, where the display-logic feature that extends several page builders passes user-supplied input directly into PHP eval() with no filtering or capability checks. An attacker holding contributor-level credentials or higher on a site running Widget Options can submit crafted input through this feature to execute arbitrary code on the web server. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability, and the changed-scope CVSS metric indicates the compromise can extend beyond the vulnerable component. All sites running Widget Options version 4.0.7 or earlier are affected. There is no public proof-of-concept or confirmed in-the-wild exploitation yet, but EPSS places the probability of exploitation within 30 days at 43.6% (99th percentile), and the vendor's patch is considered released although researchers note it could still be further hardened.

What to do: Update Widget Options to a patched release beyond 4.0.7 immediately and treat this as a priority given the high EPSS. Because the researchers note the current patch may leave residual risk, audit which contributor-and-above accounts exist on affected sites, review or restrict use of the plugin's display-logic widgets, and monitor server logs for unexpected code execution or admin activity.