Security Alert Summary
The Widget Context plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.3.3. Missing or incorrect nonce validation in the plugin allows an attacker to forge a POST request to modify widget visibility context settings if an administrator is tricked into performing an action such as clicking a link.
CVE Details
- CVE ID: CVE-2026-7615
- Affected component: Widget Context plugin for WordPress
- Affected versions: All versions up to and including 1.3.3
- Published: May 22, 2026 at 9:16:32 AM UTC
- Last modified: May 22, 2026 at 9:16:32 AM UTC
- CVSS v3.1: Base score 4.3 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Authentication / privileges / interaction: Privileges Required: None; User Interaction: Required; Attack Vector: Network
- Primary impact: Confidentiality: None; Integrity: Low (modification of widget visibility settings); Availability: None
- CWE: CWE-352 (Cross-Site Request Forgery)
Technical Details
The vulnerability exists because the plugin does not perform proper nonce validation in its save_widget_context_settings function. As a result, a forged POST request to the WordPress widgets administration endpoint (/wp-admin/widgets.php) can modify widget visibility context settings stored in the WordPress options table.
Attackers can exploit this CSRF by tricking an administrator into clicking a crafted link or visiting a page that issues the forged POST. The exploit path relies on the administrator’s browser being authenticated to the WordPress admin session; the plugin itself requires no attacker privileges to trigger the request.
Impact is limited to modification of widget visibility configuration (integrity). There is no direct indication in the provided data that confidential data is exposed or that availability is affected.
How This Could Impact Your Website
In a typical site environment, multiple roles interact with WordPress: a site owner maintains overall control, internal staff (editors or admins) manage content, and external contractors or contributors may assist with updates. If an administrator is tricked into performing the action required by this vulnerability, an attacker could change which widgets are shown or hidden across the site.
Practical consequences may include unintended public display or hiding of content blocks, which could make certain information more visible to visitors or third parties. While this issue does not directly disclose confidential data (CVSS confidentiality impact: None), altered widget visibility could indirectly assist targeted social engineering or phishing efforts if widgets display contact details or other information.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with administrative privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and widget configuration changes for unusual behavior.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/kasparsd/widget-context-wporg/pull/73
- https://plugins.trac.wordpress.org/browser/widget-context/tags/1.3.3/src/WidgetContext.php#L282
- https://plugins.trac.wordpress.org/browser/widget-context/tags/1.3.3/src/WidgetContext.php#L311
- https://plugins.trac.wordpress.org/browser/widget-context/tags/1.3.3/src/WidgetContext.php#L91
- https://plugins.trac.wordpress.org/browser/widget-context/trunk/src/WidgetContext.php#L282
- https://plugins.trac.wordpress.org/browser/widget-context/trunk/src/WidgetContext.php#L311
- https://plugins.trac.wordpress.org/browser/widget-context/trunk/src/WidgetContext.php#L91
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3c434637-4bf9-46ee-9a6d-35eab7ef11a1?source=cve
