CVE-2026-2052

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
May 2, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-205207.5In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE CVE-2026-205218.4In Video HAL, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege wiCVE-2026-205228.4In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with CVE-2026-205238.4In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with CVE-2026-205248.4In apu, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with no addCVE-2026-205255.3In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecCVE-2026-205267.5In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE CVE-2026-205275.3In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedCVE-2026-205286.7In ccci, there is a possible out of bounds write and read due to a missing bounds check. This could lead to local information disclosure, meCVE-2026-205296.7In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malCVE-2026-205310.0The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controCVE-2026-205306.7In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a mal
CVE-2026-2052: High severity, CVSS 8.8 | Vulnix