CVE-2026-27984 describes an improper control of code generation (code injection) vulnerability in the Marketing Fire Widget Options plugin (versions <= 4.1.3). The vulnerability allows an attacker with low privileges and requiring user interaction to inject and execute arbitrary code, resulting in a complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS v3.1 base score is 9.0 (critical), reflecting network attack vector, low attack complexity, limited privileges required, user interaction needed, and scope change with high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation can lead to full compromise of the affected system, including unauthorized code execution, data breach, and service disruption. The vulnerability impacts confidentiality, integrity, and availability at a high level. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with user interactions involving the Widget Options plugin and consider disabling or restricting its use if feasible.