CVE-2019-12826

HIGH 8.8CVE-2019-12826 · Published 01/07/2019 · updated 17/06/2026

In short

CVE-2019-12826 is a HIGH (CVSS 8.8) vulnerability affecting widget logic (wpchef).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.1% of all vulnerabilities.
Fix: update to 5.10.2 or later.

Package	Affected versions	Patched versions
widget logic wpchef	`< 5.10.2`	`5.10.2`

Description

A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to dynamically determine their visibility) by crafting a malicious POST request that tricks administrators into adding the code.

References

dannewitz.ninja/posts/widget-logic-csrf-to-rce · Exploit
plugins.trac.wordpress.org/changeset/2112753/widget-logic · Third Party Advisory
wpvulndb.com/vulnerabilities/9403
wpvulndb.com/vulnerabilities/9413

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free