{"id":"CVE-2026-116852","title":"WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability","summary":"Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-94"],"vendor":"Marketing Fire","product":"widget-options","affected":["widget-options >= n/a <= 4.2.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T21:21:08.723566Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T22:15:55.746Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116852","references":[{"url":"https://patchstack.com/database/wordpress/plugin/widget-options/vulnerability/wordpress-widget-options-plugin-4-2-5-remote-code-execution-rce-vulnerability?_s_id=cve"}],"tags":["cve.org"],"epss":0.00595,"epssPercentile":0.48565,"ingestedAt":"2026-11-05T16:24:31.480Z","slug":"CVE-2026-116852","body":"## Overview\n\nAuthor Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.\n\n## Affected\n\n- `widget-options >= n/a <= 4.2.5`\n\n## Remediation\n\nUpdate to 4.2.6 or a higher version.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}