CVE-2019-12826

Vulnerability

The Widget Logic plugin for WordPress before version 5.10.2 suffers from a Cross-Site Request Forgery (CSRF) vulnerability in widget_logic.php. An attacker can craft a malicious POST request that, when submitted by an authenticated administrator, injects PHP code snippets. These snippets are attached to widgets and later evaluated via eval() to determine widget visibility. The vulnerability is present in versions prior to 5.10.2.

Exploitation

An attacker must trick an authenticated WordPress administrator into making a POST request containing the malicious payload. This can be achieved through social engineering (e.g., a link or form submission on an attacker-controlled site). No other authentication or network position is required beyond the administrator's session. Once the request is processed, the PHP code snippet is saved and executed on subsequent page loads.

Impact

Successful exploitation allows remote attackers to execute arbitrary PHP code in the context of the WordPress installation. This can lead to full site compromise, including data theft, defacement, or further attacks on the server.

Mitigation

The plugin has been closed and removed from the WordPress.org directory as of April 14, 2026, and no patched version is available through official channels [1]. Users who have the plugin installed should remove it immediately and find alternative solutions. Consider using alternative widget visibility plugins. There is no official patch; the recommended mitigation is uninstalling the plugin.