CVE-2026-54823: WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability
Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.
Metrics
- CVSS v3.1
- 9.9
- Severity
- CRITICAL
- Fixed in
- —
- Affected Products
- 1
HarborGuard Analysis
Synopsis
A remote code execution vulnerability affects the Widget Options WordPress plugin at version 4.2.3 and below. The flaw is reachable over the network and requires only a low-privilege (contributor-level) account, meaning any registered user on a WordPress site can trigger it without any interaction from a victim. Successful exploitation gives the attacker full code execution within the WordPress environment, with high impact to confidentiality, integrity, and availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.
HarborGuard Coverage
Detection of CVE-2026-54823 is available across every HarborGuard environment: the CVE is ingested from upstream feeds (including the Patchstack advisory feed) within minutes of publication and matched against all customer images, including custom-built images that bundle the Widget Options plugin. Any image containing an affected version of the plugin is flagged automatically in both registry scans and CI/CD pipeline checks.
AvailableTriage is available using the CVSS v3.1 base score of 9.9 (Critical), weighted against each customer organization's compliance policy to determine urgency and escalation path. Findings are routed to the appropriate team inbox within each customer org based on policy-configured severity thresholds and ownership rules.
AvailableBecause no upstream fix version has been published for CVE-2026-54823, HarborGuard re-checks the advisory each ingest cycle and will make a patched-image rebuild available automatically the moment a fix version is released. For customers who opt into auto-remediation, the rebuild, regression test run, and PR against affected workloads will be triggered without manual intervention once an upstream patch exists.
Pending upstreamExploit Conditions
- Network reachabilityRequired
The vulnerable plugin endpoint is exposed over the network, so the attacker must be able to reach the WordPress site via HTTP/HTTPS.
- AuthenticationRequired
A low-privilege account (contributor level) is sufficient; no administrative credentials are needed, but the attacker must have at least one valid account on the target WordPress site.
- Victim interactionNot required
No victim action is required; the attacker can trigger code execution entirely through their own requests without any social-engineering step.
- Attack complexityDetail
Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race conditions, or configuration dependencies on the attacker.
Blast Radius
- Executes arbitrary code within the WordPress server process, giving the attacker control over the application runtime.
- Reads all data accessible to the web process, including database credentials, stored user records, session tokens, and secret keys held in configuration files.
- Writes or overwrites files on the server, enabling backdoor installation, content defacement, or injection of malicious code into other plugins or themes.
- Crashes or overloads the WordPress application, making the site unavailable to legitimate users.
How HarborGuard Handles This
Available on HarborGuard: because no upstream fix has been published for CVE-2026-54823, the platform monitors the Patchstack advisory and all upstream package feeds on every ingest cycle, ready to act the moment a patched version of Widget Options is released. In the meantime, customers can apply compensating controls through HarborGuard policy rules: network-policy isolation to restrict inbound access to WordPress contributor-accessible endpoints, egress filtering to limit outbound connections from the container, and flagging any image containing Widget Options <= 4.2.3 as non-deployable in production until a fix is available. For customers who opt into auto-remediation, a rebuilt image, regression test run, and PR against affected workloads will be opened automatically as soon as an upstream fix version is published, with no manual step required.
- MarketingFire / Widget Options≤ 4.2.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H