CVE-2026-2052 is a high severity remote code execution vulnerability in the Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets WordPress plugin. The issue arises from the use of eval() on user-supplied Display Logic expressions without adequate filtering, which can be bypassed using array_map with string concatenation. Additionally, there is a lack of authorization enforcement on the extended_widget_opts_block attribute. Authenticated attackers with Contributor-level permissions or higher can exploit this to execute arbitrary code on the server. Although a partial fix was applied in version 4.2.0, the vulnerability persists in versions up to 4.2.2. No official patch or remediation level has been confirmed in the vendor advisory or other sources.

Successful exploitation allows authenticated users with Contributor-level access or higher to execute arbitrary code on the server, potentially leading to full compromise of the affected WordPress site, including confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 score of 8.8, reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A partial patch was introduced in version 4.2.0, but versions up to 4.2.2 remain vulnerable. Until an official fix is confirmed, restrict Contributor-level access and above to trusted users only. Monitor for updates from the vendor and apply any official patches promptly once available.