Threats tagged 'ghsa-g2qq-qv5m-hcgq'

The Widget Options plugin for WordPress versions up to 4.2.2 contains a remote code execution vulnerability via its Display Logic feature. This flaw arises from the use of eval() on user-supplied expressions with an insufficient filtering mechanism, allowing bypass through array_map and string concatenation. Authenticated users with Contributor-level access or higher can exploit this to execute arbitrary code on the server. A partial patch was introduced in version 4.2.0, but versions up to and including 4.2.2 remain vulnerable.