The vulnerability CVE-2024-8672 affects the marketingfire WordPress plugin 'Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets' in all versions up to 4.0.7. It is caused by improper control of code generation (CWE-94) where user input is passed directly to eval() without validation or capability checks. This flaw enables authenticated attackers with contributor or higher privileges to execute arbitrary code remotely on the server, leading to full compromise. The vendor has issued a patch, but it lacks some recommended security hardening, which may leave residual risk.

Successful exploitation allows authenticated users with contributor-level access or above to execute arbitrary code on the server, potentially leading to complete server compromise, data loss, or service disruption. The vulnerability has a CVSS score of 9.9 (critical), reflecting its high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

A patch has been applied by the vendor; however, it does not fully implement all recommended security measures such as function allowlisting or restricting code execution to administrators only. Users should update to the latest plugin version provided by the vendor. Due to potential residual risk, monitoring for plugin updates and vendor advisories is recommended. Patch status is not explicitly confirmed in vendor advisory content, so users should verify the latest plugin version and vendor guidance before deployment.