CVE Intelligence
Analysis AI-assisted

CVE-2026-54823: Widget Options Plugin: Contributor Remote Code Execution

CVE-2026-54823 is a critical remote code execution issue in Widget Options versions up to and including 4.2.3, classified as CWE-94 (Code Injection). The CNA scored it 9.9 under CVSS 3.1 with a changed-scope vector that requires low privileges and no user interaction. The available records do not list fixed versions, and the vulnerability is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-54823 affects Widget Options in versions up to and including 4.2.3. The record describes a Contributor-level remote code execution flaw and maps it to CWE-94 (Code Injection). The CNA is audit@patchstack.com, and the Patchstack database entry is the only product-specific reference in the record.

Impact

  • The CNA rates the issue Critical, with a CVSS 3.1 base score of 9.9.
  • The vector indicates network attack, low complexity, low privileges, no user interaction, changed scope, and high impact on confidentiality, integrity and availability.
  • A successful attack could let an attacker run code in the context of the affected web application, which is a severe outcome for any site using the plugin.

Affected products and versions

  • The description names Widget Options in versions less than or equal to 4.2.3.
  • The structured affected-product list in the record is empty, so the exact vendor and version ranges should be confirmed on the Patchstack entry.
  • No fixed version is listed in the record. The absence of a fixed version does not mean no fix exists.

Exploitation status

No confirmed exploitation appears in the sources consulted. The record shows the CVE is not listed in CISA KEV, and no EPSS score is available.

Remediation and mitigation

  • Identify every site where Widget Options is installed, including inactive copies, and record the installed version.
  • Check the Patchstack entry and the official plugin source for a release newer than 4.2.3 and apply it as soon as it is verified.
  • If no fixed release is available, consider deactivating or removing the plugin until a fix is published.
  • Review which accounts hold the Contributor role and remove any that are unnecessary, since the record's description and privilege requirement point to this role.

Detection guidance

  • Review web server and application logs for unexpected requests to plugin endpoints from low-privileged accounts.
  • Check for new or modified PHP files, unexpected plugin changes, and unfamiliar administrative users.
  • Monitor for outbound connections or processes that the site does not normally make.

Limitations of the available information

  • The record contains no fixed version, no affected version range beyond the description, and no technical details of the flaw.
  • The product name is taken from the reference URL and description; the vendor and plugin ecosystem are not explicitly confirmed in the record text.
  • The CVSS score comes from the CNA; no NVD score is shown in the record.

Frequently asked questions

Is CVE-2026-54823 being actively exploited?

No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Which versions of Widget Options are affected?

The description says versions less than or equal to 4.2.3. The structured affected-product list in the record is empty, so confirm ranges on the Patchstack entry.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.