CVE-2026-14158

Description

The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequent use in an eval() call. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.

PUBLISHED Reserved 2026-06-30 | Published 2026-07-08 | Updated 2026-07-08 | Assigner Wordfence

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Timeline

Credits

Nabil Irawan finder

References

www.wordfence.com/...-c572-4911-a6a5-1384844214b0?source=cve

plugins.trac.wordpress.org/...-logic-visual/trunk/custom.php

plugins.trac.wordpress.org/...et-logic-visual/trunk/ajax.php

plugins.trac.wordpress.org/...et-logic-visual/trunk/ajax.php

cve.org (CVE-2026-14158)

nvd.nist.gov (CVE-2026-14158)

Download JSON