AIKIDO-2026-970031

TL;DR

is_safe_widget_instance() does not stop PHP from firing magic methods during unserialize pre-parse, and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() runs. An unauthenticated commenter can submit a crafted wp:legacy-widget block; the V2 single-event template runs do_blocks() over buffered comment HTML, and the moderation-hash URL lets the commenter view the pending comment immediately, so the payload reaches the sink before moderation. Successful exploitation leads to remote code execution. The fix hardens the widget-instance safety check so forged hashes and magic-method gadgets cannot reach unserialize().