The Widget Options plugin contains an improper control of code generation vulnerability that permits attackers to inject and execute arbitrary code, a type of code injection flaw identified as CWE‑94. This can lead to full remote code execution on the web server, compromising confidentiality, integrity, and availability of the site and any data stored there.

The vulnerability impacts the Marketing Fire Widget Options plugin, commonly known as Widget Options. All releases from the original launch through version 4.1.3 are affected.

The CVSS score of 9 indicates a critical severity level, yet the EPSS score of less than 1% suggests that exploitation has a low probability in the wild at this time. The flaw is not listed in the CISA KEV catalog. Attackers would likely exploit the flaw by sending crafted requests to the plugin’s input fields, possibly via the plugin’s front‑end or administrative interface; the attack vector is inferred to be remote through web traffic.