CVE-2025-6784

Deferred Deferred - Pending Action

Remote Code Execution in Code Engine WordPress Plugin

Publication date: 2026-07-11

Last updated on: 2026-07-13

Assigner: Wordfence

Description

The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-11

Last Modified

2026-07-13

Generated

2026-07-31

AI Q&A

2026-07-11

EPSS Evaluated

2026-07-30

NVD

CVE-2025-6784

EUVD

EUVD-2025-210455

Affected Vendors & Products

Vendor	Product	Version / Range
code_engine	code_engine	to 0.3.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

The Code Engine plugin for WordPress has a vulnerability that allows Remote Code Execution (RCE) in all versions up to and including 0.3.5. This occurs through the 'code-engine' shortcode because the plugin does not restrict access to its code injecting functionality.

As a result, authenticated attackers with Contributor-level access or higher can execute arbitrary code on the server.

Impact Analysis

This vulnerability can have severe impacts because it allows attackers with relatively low privileges (Contributor-level access) to execute arbitrary code on the server.

Complete compromise of the server hosting the WordPress site.
Potential data theft or data loss.
Defacement or unauthorized modification of website content.
Use of the server for further attacks or malicious activities.

Compliance Impact

This vulnerability allows authenticated attackers with Contributor-level access and above to execute code on the server, potentially leading to unauthorized access, data breaches, and manipulation of sensitive information.

Such unauthorized code execution and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls to protect personal and sensitive data from unauthorized access and breaches.

Mitigation Strategies

To mitigate this vulnerability, you should update the Code Engine plugin for WordPress to a version later than 0.3.5 where the issue is fixed.

Additionally, restrict Contributor-level and above users from accessing the 'code-engine' shortcode functionality until the update is applied.

Consider reviewing user permissions to limit the number of users with Contributor-level access or higher.

Hi! I’m here to help you understand CVE-2025-6784. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70