Back to overview

CVE-2026-45293

HIGH
8.6
CVSS 3.1
Description
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.

Metadata

CVE ID
CVE-2026-45293
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-11 20:14 UTC
Published
2026-07-28 15:34 UTC
Last updated
2026-07-28 15:34 UTC
Primary CWE
CWE-95
CWE-95: Improper Neutralization of Directives in Dynamically…
Vendor / Product
WordPress / WordPress-Coding-Standards
Sources
cve.org  ·  NVD

Severity & Metrics

8.6 HIGH CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products (1)
VendorProductPlatformVersions
WordPress WordPress-Coding-Standards — >= 0.14.1, < 3.4.1
Weakness (CWE)
CWESourceDescription
CWE-95 cna CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.6 HIGH 3.1 cna CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References (4)
Back to overview