Attack Chain

1. An attacker obtains valid Contributor-level (or higher) credentials for a WordPress website using the vulnerable Code Engine plugin.
2. The attacker logs into the WordPress administrative interface using the compromised credentials.
3. The attacker crafts a malicious [code-engine] shortcode, embedding arbitrary PHP code (e.g., <?php system('id'); ?>) within it.
4. The attacker creates a new post or page, or modifies an existing one, inserting the malicious [code-engine] shortcode into the content.
5. The attacker publishes or saves the post/page, triggering the WordPress system to process the content.
6. When WordPress renders the content, the Code Engine plugin processes the [code-engine] shortcode.
7. Due to the vulnerability, the plugin executes the embedded PHP payload, leading to Remote Code Execution on the web server.

Impact

Successful exploitation of CVE-2025-6784 allows an authenticated attacker to achieve Remote Code Execution on the web server. This can lead to a complete compromise of the affected WordPress site, enabling attackers to deface the website, inject malware, steal sensitive data from the database, or establish persistence on the server. Furthermore, RCE can serve as an initial foothold for attackers to pivot to other systems within the organization's network. The high CVSS score of 8.8 reflects the significant impact on confidentiality, integrity, and availability.

Recommendation

• Immediately update the Code Engine plugin for WordPress to a version greater than 0.3.5, as referenced in the WordPress changeset [https://plugins.trac.wordpress.org/changeset/3345666].
• Deploy a web application firewall (WAF) to detect and block HTTP POST requests targeting WordPress administrative endpoints (e.g., /wp-admin/post.php, /wp-json/wp/v2/posts) that contain the [code-engine] shortcode along with suspicious PHP function calls, as described in the detection rules below.
• Monitor web server logs for suspicious HTTP POST requests as identified by the Sigma rule "Detects CVE-2025-6784 Exploitation - Malicious WordPress Shortcode Submission" for potential exploitation attempts.
• Regularly audit WordPress user accounts and their assigned roles to ensure least privilege principles are applied, reducing the impact of compromised credentials.