Widget Options <= 4.1.0 is vulnerable to Arbitrary Code Execution vulnerability

Contributor

Published
2025-02-10

The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

CVE

https://www.cve.org/CVERecord?id=CVE-2025-22630

CVSS

Score:9.9

Severity:Critical

Version: 4.1.0

There is a patch available in v4.1.1 and we strongly recommend you update to this version as soon as possible.