CVE Intelligence
Analysis AI-assisted

CVE-2026-25447: Widget Wrangler WordPress Plugin - Code Injection (CWE-94)

A code injection vulnerability (CWE-94) affects the Widget Wrangler WordPress plugin by Jonathan Daggerhart, according to the record for versions up to and including 2.3.9. The CNA audit@patchstack.com scored it 9.1 (critical) under CVSS 3.1. No confirmed exploitation appears in the sources consulted, and no fixed version is listed in the record.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a code injection weakness (CWE-94) in the Widget Wrangler WordPress plugin by Jonathan Daggerhart. The stated range is from n/a through 2.3.9 (less than or equal to 2.3.9). The CVE was published on 2026-03-25 and the CNA is audit@patchstack.com.

Impact

The CNA assigned a CVSS 3.1 base score of 9.1, rated critical. The vector in the record describes a network-reachable attack with low complexity, high privileges required, no user interaction, a changed scope, and high impact on confidentiality, integrity and availability.

Affected products and versions

  • Product: Widget Wrangler (widget-wrangler), a WordPress plugin by Jonathan Daggerhart.
  • Range stated in the record: from n/a through 2.3.9.
  • The record contains no structured affected or fixed version entries, so the exact boundaries should be confirmed with the vendor or the Patchstack entry.

Exploitation status

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the data consulted. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify every WordPress site that runs Widget Wrangler and record the installed version.
  • Update to a release newer than 2.3.9 once the plugin source publishes one. The record does not identify a fixed version.
  • If no fixed version is available and the plugin is not essential, deactivate and remove it.
  • Limit administrative access and restrict who can install or manage plugins, since the vector indicates high privileges are required.
  • Keep WordPress core and other plugins current, and review the Patchstack entry for vendor-independent details.

Detection guidance

  • Inventory plugin versions across production, staging and development sites.
  • Review web server and application logs for unusual requests to the plugin.
  • Watch for unexpected changes to plugin or theme files and for newly created administrator accounts.

Limitations of the available information

The record gives no structured affected or fixed versions, no technical description of the vulnerable code path, and an EPSS value without context. The title field was empty, so the title was derived from the description. The contents of the referenced Patchstack page were not verified in this analysis.

Frequently asked questions

Is CVE-2026-25447 known to be actively exploited?

It is not listed in the CISA KEV catalog in the data consulted, and no confirmed exploitation appears in the sources consulted.

Which Widget Wrangler versions are affected?

The record states a range from n/a through 2.3.9, but it lists no structured affected or fixed version entries.

What should site owners do now?

Identify installations, restrict administrative access, and update to a fixed release when one is published. If no fix exists and the plugin is not essential, remove it.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.