CVE-2026-14158: Widget Logic Visual WordPress RCE Flaw

CVE-2026-14158 Overview

CVE-2026-14158 is a Remote Code Execution vulnerability in the Widget Logic Visual plugin for WordPress affecting all versions up to and including 1.52. The flaw resides in the widget_logic_visual_check_visibility function, where the widget-logic-update-conditional-tags AJAX action lacks both capability checks and nonce verification. Attacker-controlled input from the nwlv[cod-tag] parameter is stored without adequate sanitization and later passed to an eval() call. Authenticated attackers with subscriber-level access or higher can execute arbitrary PHP code on the underlying server. The vulnerability is classified under [CWE-434] and carries a CVSS score of 8.8.

Critical Impact
Authenticated subscribers can achieve arbitrary PHP code execution on the WordPress server, resulting in full site compromise.

Affected Products

WordPress Widget Logic Visual plugin, all versions through 1.52
WordPress sites that permit subscriber-level registration and run the affected plugin
Any hosting environment executing the vulnerable AJAX endpoint

Discovery Timeline

2026-07-08 - CVE-2026-14158 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14158

Vulnerability Analysis

The Widget Logic Visual plugin registers an AJAX endpoint named widget-logic-update-conditional-tags that invokes widget_logic_visual_check_visibility. The handler processes requests from any authenticated WordPress user, including low-privilege subscribers, because it neither invokes current_user_can() nor calls check_ajax_referer(). Attacker-supplied data arrives through the nwlv[cod-tag] parameter, which the plugin stores in the WordPress options table. When widgets are subsequently rendered, the stored expression is passed directly to PHP's eval() function in custom.php, executing whatever code the attacker submitted.

Because the attack requires only a subscriber account, environments that allow open user registration are exposed to unauthenticated attackers who first register an account. The attacker gains the ability to run arbitrary PHP with the privileges of the web server process, enabling webshell deployment, credential theft from wp-config.php, and lateral movement.

Root Cause

Three defects compound to produce the vulnerability. First, the AJAX handler omits capability checks. Second, it omits nonce verification, permitting CSRF-adjacent abuse. Third, the plugin trusts the stored cod-tag value and passes it to eval() without sanitization or an allow-list of expected expressions. Classification under [CWE-434] reflects the unrestricted persistence of attacker-controlled executable content.

Attack Vector

An authenticated user sends a POST request to admin-ajax.php with action=widget-logic-update-conditional-tags and a crafted nwlv[cod-tag] payload containing PHP code. The payload is written to plugin options. When any page load triggers widget visibility evaluation, the payload passes through eval() and executes. Full technical references are available in the Wordfence Vulnerability Report and the WordPress Widget Logic Visual source.

// No verified exploitation code available.
// Refer to the Wordfence advisory and plugin source for technical details.

Detection Methods for CVE-2026-14158

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=widget-logic-update-conditional-tags originating from low-privilege user sessions
Unexpected PHP syntax, function calls, or backticks stored in plugin options under widget-logic-visual keys
New administrator accounts, unexpected files in the WordPress uploads directory, or modified wp-config.php following the AJAX activity
Outbound network connections from PHP-FPM or the web server process to unfamiliar hosts

Detection Strategies

Audit WordPress access logs for the widget-logic-update-conditional-tags action tied to non-administrator user IDs
Inspect the wp_options table for entries associated with the plugin that contain PHP tokens such as system(, exec(, base64_decode(, or passthru(
Alert on PHP processes spawning shell interpreters (sh, bash, cmd.exe) or writing to web-accessible directories

Monitoring Recommendations

Enable WordPress audit logging for AJAX actions and plugin option modifications
Forward web server and PHP error logs to a centralized SIEM for correlation against subscriber account activity
Monitor for creation of new PHP files under wp-content/ and unexpected changes to plugin-managed options

How to Mitigate CVE-2026-14158

Immediate Actions Required

Deactivate and remove the Widget Logic Visual plugin until a patched version is confirmed available
Disable open user registration or restrict the default role to a value that cannot reach the vulnerable AJAX endpoint
Rotate WordPress administrator credentials and secrets stored in wp-config.php if compromise is suspected
Review the wp_options table and remove any suspicious cod-tag values

Patch Information

No fixed version is identified in the published advisory at the time of NVD publication on 2026-07-08. Consult the Wordfence Vulnerability Report for updates on a vendor patch and upgrade guidance.

Workarounds

Block requests to admin-ajax.php with the widget-logic-update-conditional-tags action at the WAF or reverse proxy layer
Restrict admin-ajax.php access to authenticated administrators via server-level rules where feasible
Remove the plugin directory wp-content/plugins/widget-logic-visual/ to eliminate the vulnerable code path

bash

# Remove the vulnerable plugin from the WordPress installation
wp plugin deactivate widget-logic-visual
wp plugin delete widget-logic-visual

# Optional: block the vulnerable AJAX action at the web server (nginx example)
# location = /wp-admin/admin-ajax.php {
#     if ($arg_action = "widget-logic-update-conditional-tags") { return 403; }
# }