{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/wordpress-coding-standards-vulnerable--0.14.1--3.4.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WordPress Coding Standards (vulnerable: \u003e= 0.14.1, \u003c 3.4.1)"],"_cs_severities":["high"],"_cs_tags":["wordpress","code-execution","vulnerability","php","ci/cd"],"_cs_type":"threat","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eWordPress Coding Standards (WordPressCS) versions prior to 3.4.1 contain a critical arbitrary code execution vulnerability, identified as CVE-2026-45293, affecting the \u003ccode\u003eWordPress.WP.EnqueuedResourceParameters\u003c/code\u003e sniff. This vulnerability allows an attacker to execute arbitrary commands on the host running PHP CodeSniffer (PHPCS) if it processes untrusted PHP code. Specifically, a malicious \u003ccode\u003e$ver\u003c/code\u003e argument crafted within functions like \u003ccode\u003ewp_enqueue_script()\u003c/code\u003e or \u003ccode\u003ewp_register_script()\u003c/code\u003e can be directly executed via \u003ccode\u003eeval()\u003c/code\u003e by the vulnerable sniff during the code analysis process. This poses a significant risk to development environments, CI/CD pipelines, and any developer machines reviewing third-party code, particularly when using the \u003ccode\u003eWordPress\u003c/code\u003e or \u003ccode\u003eWordPress-Extra\u003c/code\u003e rulesets. The vulnerability does not require active exploitation of a WordPress site itself but targets the code scanning infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious PHP code snippet, for instance, by embedding a system command within the \u003ccode\u003e$ver\u003c/code\u003e argument of \u003ccode\u003ewp_enqueue_script()\u003c/code\u003e or \u003ccode\u003ewp_register_script()\u003c/code\u003e, such as \u003ccode\u003ewp_enqueue_script('handle', 'src', [], 'system'('id'))\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker introduces this malicious code into a project, potentially via a pull request in a software development lifecycle (SDLC) that uses automated code linting.\u003c/li\u003e\n\u003cli\u003eA developer or an automated CI/CD pipeline runs PHPCS with the affected WordPressCS versions (specifically, the \u003ccode\u003eWordPress\u003c/code\u003e or \u003ccode\u003eWordPress-Extra\u003c/code\u003e rulesets) to analyze the untrusted PHP code.\u003c/li\u003e\n\u003cli\u003eDuring the scan, the \u003ccode\u003eWordPress.WP.EnqueuedResourceParameters\u003c/code\u003e sniff is triggered to check the \u003ccode\u003e$ver\u003c/code\u003e argument for falsy values.\u003c/li\u003e\n\u003cli\u003eThe sniff's internal \u003ccode\u003eis_falsy()\u003c/code\u003e method reconstructs the attacker's malicious \u003ccode\u003e$ver\u003c/code\u003e argument.\u003c/li\u003e\n\u003cli\u003eThe reconstructed malicious argument is then passed to and executed by PHP's \u003ccode\u003eeval()\u003c/code\u003e function within the context of the scanning host.\u003c/li\u003e\n\u003cli\u003eThe embedded system command, such as \u003ccode\u003esystem('id')\u003c/code\u003e, is executed on the CI/CD server or developer's machine.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves arbitrary code execution on the host performing the code analysis, potentially leading to compromise of the development environment or infrastructure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability directly leads to arbitrary code execution on systems running PHPCS with affected WordPressCS versions. While it does not directly compromise WordPress installations, it significantly impacts developer workstations, CI/CD pipelines, and any infrastructure responsible for code review and static analysis. A successful exploitation grants the attacker control over the scanning host, allowing for further lateral movement, data exfiltration, or supply chain attacks by injecting malicious code into repositories. All organizations utilizing WordPressCS for linting PHP code, particularly those processing untrusted code, are at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade WordPress Coding Standards to version 3.4.1 or later to remediate CVE-2026-45293.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not feasible, disable the \u003ccode\u003eWordPress.WP.EnqueuedResourceParameters\u003c/code\u003e sniff by adding an \u003ccode\u003e\u0026lt;exclude\u0026gt;\u003c/code\u003e tag to your custom ruleset, as detailed in the workaround section of the advisory.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T14:32:34Z","date_published":"2026-07-28T14:32:34Z","id":"https://feed.craftedsignal.io/briefs/2026-07-wordpress-cs-rce/","summary":"WordPress Coding Standards (WordPressCS) versions before 3.4.1 are vulnerable to arbitrary code execution due to a flaw in the `WordPress.WP.EnqueuedResourceParameters` sniff, allowing an attacker to execute arbitrary commands on the scanning host by crafting a malicious `$ver` argument, posing a risk for users running PHPCS with specific rulesets in CI pipelines or developer environments.","title":"WordPress Coding Standards Contains an Arbitrary Code Execution Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-wordpress-cs-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - WordPress Coding Standards (Vulnerable: \u003e= 0.14.1, \u003c 3.4.1)","version":"https://jsonfeed.org/version/1.1"}