CVE-2026-27984: 
WordPress vulnerability analysis and mitigation

CVE-2026-27984 is a Code Injection (Remote Code Execution) vulnerability in the Marketing Fire Widget Options WordPress plugin, affecting versions up to and including 4.1.3. Discovered and reported by researcher 'mcdruid' on October 4, 2025, and published on March 2–5, 2026, the vulnerability allows authenticated attackers with low privileges (Contributor or Developer role) to inject and execute arbitrary code. It carries a CVSS v3.1 base score of 9.0 (High/Critical) (Patchstack, Feedly).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), meaning the plugin fails to properly sanitize or restrict user-controlled input before it is evaluated as executable code. The attack vector is network-based with low attack complexity, requiring an authenticated user with low privileges (Contributor or Developer level) and some form of user interaction to trigger execution. The changed scope indicates that successful exploitation can affect components beyond the vulnerable plugin itself, potentially compromising the broader WordPress application environment. No detailed technical write-up or public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the target WordPress server, potentially enabling full website takeover, backdoor installation, data exfiltration, and defacement. The vulnerability carries high impact across confidentiality, integrity, and availability — sensitive data may be exposed, website content modified, and service availability disrupted. The changed scope means the impact can extend beyond the plugin to the entire WordPress application and underlying server environment (Patchstack, Feedly).

As of the time of reporting, no public proof-of-concept exploit has been identified and no active in-the-wild exploitation has been confirmed. The EPSS score is approximately 0.029% (0.000290), indicating a currently low probability of exploitation in the near term. However, Patchstack classifies this as high priority and notes that vulnerabilities of this severity class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. No threat actor attribution or CISA KEV catalog listing has been identified (Patchstack, Feedly).

The vendor has released a patched version: Widget Options 4.2.0. All users running version 4.1.3 or earlier should update immediately. If an immediate update is not possible, restrict access to the widget options administrative interface to trusted, high-privilege users only and apply the principle of least privilege. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploit attempts until the plugin is updated (Patchstack).

Wordfence included CVE-2026-27984 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as a notable issue for WordPress site administrators. Sucuri also referenced the vulnerability in its March 2026 vulnerability patch roundup. Patchstack, the assigning CNA, classified it as high priority and issued a virtual mitigation rule for its users (Wordfence, Sucuri, Patchstack).