WordPress Widget Options plugin versions 4.2.5 and older contain a remote code execution flaw. Based on the description, it is inferred that the plugin processes input that an attacker can manipulate, resulting in arbitrary PHP code execution on the server. This violation of the authentication boundary allows an attacker to compromise the confidentiality, integrity, and availability of the affected site.

The vulnerability affects the Marketing Fire Widget Options plugin shipped with WordPress sites. All installations running any release up to and including 4.2.5 are potentially exposed if the plugin is enabled.

The CVSS score of 9.1 indicates critical severity, and the attack can be carried out remotely without local access. The EPSS score is not available, but the lack of an existing KEV listing does not reduce the urgency. Based on the description, the likely attack vector involves sending crafted input to a privileged endpoint of the plugin, which can lead to execution of arbitrary PHP code. Prompt patching is therefore essential.