The Widget Context plugin for WordPress has a missing or incorrectly implemented nonce check in its settings update routine, enabling a cross‑site request forgery attack. An attacker who can trick an authenticated administrator into visiting a crafted URL can submit a forged POST request to the /wp-admin/widgets.php endpoint and change the visibility context of widgets stored in the WordPress options table. This results in the attacker's ability to alter which users see which widgets, potentially exposing hidden content or degrading user experience.

The vulnerability affects all installations of the Widget Context plugin by kasparsd running version 1.3.3 or earlier. Any WordPress site that has not upgraded beyond that version is exposed.

The vulnerability has a CVSS score of 4.3, indicating moderate impact and moderate likelihood of exploitation. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw relies on CSRF, an attacker must first compromise the victim’s browser session and convince a site administrator to act, which raises the effort and skill required. Nonetheless, the potential for unauthorized configuration changes warrants prompt remediation.