CVE-2026-45293
Received Received - Intake

Arbitrary Code Execution in WordPress Coding Standards

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-45293
EUVD
EUVD-2026-49877

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wp_coding_standards php_codesniffer From 0.14.1 (inc) to 3.4.1 (inc)
wordpress wordpress_coding_standards From 0.14.1 (inc) to 3.4.1 (exc)
wordpress wordpress_coding_standards 3.4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects WordPress Coding Standards (WordPressCS) versions before 3.4.1. It involves the WordPress.WP.EnqueuedResourceParameters sniff using eval() to check falsy values in arguments for functions like wp_enqueue_script(). A crafted $ver argument (e.g., 'system'('id')) could execute arbitrary commands during a PHPCS scan, compromising the scanning host.

Detection Guidance

To detect this vulnerability, check if your WordPress Coding Standards (WordPressCS) version is below 3.4.1. Run 'phpcs --version' to verify the installed version. If using WordPress or WordPress-Extra rulesets, inspect PHPCS scans for unexpected command execution during falsy value checks in wp_enqueue_script() or wp_register_script() calls.

Impact Analysis

If you use WordPressCS versions before 3.4.1 with the WordPress or WordPress-Extra rulesets, scanning untrusted PHP code (e.g., CI pipelines or third-party code reviews) could execute malicious commands on your system. This may lead to unauthorized access, data theft, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating GDPR (data protection) or HIPAA (health data security) by exposing sensitive data or systems. Compliance may be impacted if systems are compromised due to the flaw.

Mitigation Strategies

Immediately upgrade to WordPressCS version 3.4.1 or later. Update PHPCSUtils to version 1.2.3 and PHPCSExtra to version 1.5.1. As a temporary workaround, disable the WordPress.WP.EnqueuedResourceParameters sniff in your PHPCS ruleset configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart