CVE-2024-8672
The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.7 via the display logic fun...
Affects 0 products across 4 vendors.
Attacker injects arbitrary code that is executed by the application process.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
The Widget Options plugin for WordPress is vulnerable to Remote Code Execution (RCE) due to improper input validation and use of eval() without filtering or capability checks. This vulnerability affects all versions up to and including 4.0.7, allowing authenticated attackers with contributor-level access to execute arbitrary code on the server. The vendor has partially addressed the issue, but residual risk remains.
BSID: BS-2024-GLOBAL-045098-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-8672?
What is the CVSS score for CVE-2024-8672?
Is CVE-2024-8672 actively exploited?
How do I remediate CVE-2024-8672?
What systems are affected by CVE-2024-8672?
What NERC-CIP standard applies to CVE-2024-8672?
What IEC 62443 requirement maps to CVE-2024-8672?
| CVE ID | CVE-2024-8672 |
|---|---|
| BSID | BS-2024-GLOBAL-045098-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Published | 2024-11-28 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.7 via the display logic functionality that extends several page builders. This is due to the plugin allowing users to supply input that will be passed through eval() without any filtering or capability checks. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. Special note: We suggested the vendor implement an allowlist of functions and limit the ability to execute commands to just administrators, however, they did not take our advice. We are considering this patched, however, we believe it could still be further hardened and there may be residual risk with how the issue is currently patched.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from the display logic functionality that extends several page builders. The plugin allows users to supply input that is passed through eval() without any filtering or capability checks. This enables authenticated attackers with contributor-level access to execute arbitrary code on the server, leading to potential full control over the affected system.
Exploitation Likelihood: HIGH
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict input validation and restrict the use of eval() to administrative users only. Additionally, monitor and log all requests to the affected plugin's endpoints.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 as it allows unauthorized access to the system, which could compromise the security of the control system and its data.
This CVE maps to SR 7.6 as it involves a vulnerability that could allow unauthorized access and execution of arbitrary code, which is a critical security risk for industrial control systems.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 0f569d6d1fa256d3dcc4fc650f937b6a377479abc35505a9b8a95846727c2d347d491496d05ed5f213e1bcea4dc8c1e1d992dfe704e3ebef481c4ea252ab433d |
Critical Severity - Know Your Exposure
A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →