CVE-2026-116615: Widget Options <= 4.2.6.1 - Authenticated (Contributor+) Code Injection via 'post_content' Parameter

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the postcontent parameter. This is due to asymmetric parsing between the save-time strip filter (widgetoptsstriplogicfromblocks()) and the render-time parser (blockoptsfilterbeforedisplay()): embedding an inner <!--startwidgetopts literal inside a JSON key causes the write-side jsondecode to see a non-class key and skip stripping — persisting the payload verbatim to the database — while the render-side strreplace reconstitutes the key to class, feeding the attacker-controlled logic value directly into @eval. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary getoption, getusermeta, and getpostmeta values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the widgetoptsallowedphpfunctions filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes widgetoptssafeevaltrusted() to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above.