CVE-2026-14158 affects the Widget Logic Visual WordPress plugin through the widget_logic_visual_check_visibility function. The vulnerability arises because the widget-logic-update-conditional-tags AJAX action lacks proper capability checks and nonce verification. Additionally, the 'nwlv[cod-tag]' parameter is not sufficiently sanitized before being stored and used in an eval() call, enabling authenticated attackers with subscriber-level privileges or higher to execute arbitrary code remotely on the server. This vulnerability is categorized as CWE-434 and impacts all versions up to and including 1.52.

Successful exploitation allows an authenticated user with subscriber-level access or higher to execute arbitrary code on the server, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). This could result in unauthorized access, data manipulation, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the remediation level is unspecified, users should monitor the vendor's communications for updates. Until a patch is available, restrict access to trusted users only and consider disabling or removing the Widget Logic Visual plugin if possible to mitigate risk.