The WordPress plugin Widget Logic Visual contains a missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action. The 'nwlv[cod-tag]' parameter is stored without proper sanitization and later passed directly to eval(), allowing an authenticated user to inject malicious PHP code. This flaw, classified as CWE-434, provides an attacker the ability to execute arbitrary code in the web‑server context, potentially compromising the entire site and any services running on the same host.

The vulnerability exists in the Widget Logic Visual plugin from totalbounty for all releases up to version 1.52. Users with at least subscriber‑level privileges can exploit the flaw by editing a widget. The plugin is distributed through the official WordPress plugin repository and can be updated via the dashboard.

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog, so no public exploits are recorded there. Based on the description, it is inferred that the likely attack vector is the widget-logic-update-conditional-tags AJAX endpoint; an attacker who can log in as a subscriber can easily craft a request that bypasses the missing checks, stores malicious PHP, and triggers eval(), presenting a straightforward path to full server compromise.