A legacy widget is the older WordPress widget format used before block-based widgets. Unlike modern blocks, legacy widgets may rely on different rendering paths, older settings structures, and special parsing rules. That makes them important in security reviews because code that handles them can behave differently from the rest of the site.
In cyber security, legacy widget support matters when a plugin processes widget data as trusted presentation content but still touches untrusted input such as titles, shortcodes, serialized settings, or callback references. If validation is weak, an attacker may use the widget path to trigger object injection, code execution, or unsafe template rendering. Defenders should treat legacy widget features as attack surface, keep plugins updated, test migrated configurations, and disable old widget logic when it is no longer needed.