Attack Chain

1. An attacker crafts a malicious PHP code snippet, for instance, by embedding a system command within the $ver argument of wp_enqueue_script() or wp_register_script(), such as wp_enqueue_script('handle', 'src', [], 'system'('id')).
2. The attacker introduces this malicious code into a project, potentially via a pull request in a software development lifecycle (SDLC) that uses automated code linting.
3. A developer or an automated CI/CD pipeline runs PHPCS with the affected WordPressCS versions (specifically, the WordPress or WordPress-Extra rulesets) to analyze the untrusted PHP code.
4. During the scan, the WordPress.WP.EnqueuedResourceParameters sniff is triggered to check the $ver argument for falsy values.
5. The sniff's internal is_falsy() method reconstructs the attacker's malicious $ver argument.
6. The reconstructed malicious argument is then passed to and executed by PHP's eval() function within the context of the scanning host.
7. The embedded system command, such as system('id'), is executed on the CI/CD server or developer's machine.
8. The attacker achieves arbitrary code execution on the host performing the code analysis, potentially leading to compromise of the development environment or infrastructure.

Impact

This vulnerability directly leads to arbitrary code execution on systems running PHPCS with affected WordPressCS versions. While it does not directly compromise WordPress installations, it significantly impacts developer workstations, CI/CD pipelines, and any infrastructure responsible for code review and static analysis. A successful exploitation grants the attacker control over the scanning host, allowing for further lateral movement, data exfiltration, or supply chain attacks by injecting malicious code into repositories. All organizations utilizing WordPressCS for linting PHP code, particularly those processing untrusted code, are at risk.

Recommendation

• Immediately upgrade WordPress Coding Standards to version 3.4.1 or later to remediate CVE-2026-45293.
• If immediate upgrade is not feasible, disable the WordPress.WP.EnqueuedResourceParameters sniff by adding an <exclude> tag to your custom ruleset, as detailed in the workaround section of the advisory.