CVE-2026-7615 is a Cross-Site Request Forgery vulnerability in the Widget Context plugin for WordPress, affecting all versions up to and including 1.3.3. The issue arises from missing or incorrect nonce validation on the save_widget_context_settings function, which handles saving widget visibility context settings. An attacker can exploit this by crafting a forged POST request to /wp-admin/widgets.php and convincing an authenticated site administrator to perform the action, thereby modifying widget settings without proper authorization.

Successful exploitation allows an attacker to modify widget visibility context settings stored in the WordPress options table without authentication, potentially altering site behavior or appearance. The vulnerability does not impact confidentiality or availability but has a limited integrity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or requests while logged into WordPress with administrative privileges. Monitoring for updates from the kasparsd project or WordPress plugin repository is recommended to apply any forthcoming patches promptly.