CVE-2024-8672

🗓️ 28 Nov 2024 09:47:11Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 139 Views🌐 WEB

Widget Options plugin for WordPress is vulnerable to Remote Code Execution via display logic functionality in all versions up to 4.0.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2024-8672	2 Dec 202419:59	–	githubexploit
BDU FSTEC	The vulnerability of the eval() function in the Widget Options plugin of the WordPress content management system allows a hacker to execute arbitrary code.	6 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-8672	28 Nov 202410:04	–	circl
CNNVD	WordPress plugin Widget Options 代码注入漏洞	28 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-8672 Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution	28 Nov 202409:47	–	cvelist
NVD	CVE-2024-8672	28 Nov 202410:15	–	nvd
Patchstack	WordPress Widget Options plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution vulnerability	27 Nov 202423:22	–	patchstack
Patchstack	WordPress Widget Options Plugin <= 4.0.7 is vulnerable to Remote Code Execution (RCE)	27 Nov 202400:00	–	patchstack
RedhatCVE	CVE-2024-8672	4 Feb 202522:45	–	redhatcve
The Hacker News	THN Recap: Top Cybersecurity Threats, Tools and Tips (Nov 25 - Dec 1)	2 Dec 202411:14	–	thn

[
  {
    "vendor": "marketingfire",
    "product": "Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.0.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/8d03af4d-a1f9-4c15-a62e-f4cdbcfc9af7
plugins	www.plugins.trac.wordpress.org/browser/widget-options/trunk/includes/pagebuilders/elementor/render.php
plugins	www.plugins.trac.wordpress.org/browser/widget-options/trunk/includes/pagebuilders/beaver/beaver.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php

Parameter	Position	Path	Description	CWE
attributes[extended_widget_opts][class][logic]	query param	wp-json/wp/v2/block-renderer/core/latest-comments	Authenticated Contributor RCE via widget options plugin—execution through logic parameter in widget configuration	CWE-94

17 Jun 2026 08:23Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.9

EPSS0.43577

SSVC

CWE-94