The WordPress Plugin Widget Logic Visual is vulnerable to Remote Code Execution as a result of inadequate security controls in the widget-logic-update-conditional-tags AJAX action. The missing capability check and nonce verification allow an authenticated user with subscriber-level access to supply arbitrary content in the 'nwlv[cod-tag]' parameter. Because the plugin stores this value and later passes it directly to eval(), an attacker can execute arbitrary PHP code on the server. This flaw maps to CWE-434 and permits a fully executing payload to run in the context of the web server. The primary impact is the compromise of server code, integrity, confidentiality and availability responsibilities, potentially leading to full system compromise. The attack is not limited to a single user; once an attacker gains execution they can affect the entire WordPress site.

The plugin totalbounty: Widget Logic Visual in WordPress versions up to and including 1.52 is affected. No other versions have been reported as vulnerable. The plugin can be found and updated through the WordPress plugin repository, likely the standard distribution channel.

The vulnerability carries a CVSS score of 8.8, indicating a high severity. EPSS score is < 1%, indicating a very low yet non-zero exploitation probability, although subscriber privileges are common and could allow an attacker with valid credentials to exploit the weakness. The vulnerability is not listed in the CISA KEV catalog, so no known exploit samples are documented in that database. The attack vector is an authenticated AJAX request to the widget-logic-update-conditional-tags endpoint where the 'nwlv[cod-tag]' field is set and saved before execution. With no nonce check or capability restriction, the path to exploitation is straightforward for a subscriber who can navigate to the widget editing interface.