WP Coder PHP Code Execution Vulnerability

Executive Summary

CVE-2026-104677 is a Remote Code Execution (RCE) vulnerability in the WP Coder WordPress plugin versions 4.0 to 4.5.1. It allows users with the Editor role to execute arbitrary PHP code on the server by bypassing access restrictions. The plugin fails to properly restrict its PHP code-execution feature, which should only be available to administrators.

Useful 0 Not Useful 0

Detection Guidance

Check if the WP Coder plugin version is between 4.0 and 4.5.1. Use WordPress admin panel to inspect installed plugins or run: wp plugin list --name=wp-coder. If vulnerable, update to version 4.5.2 or later immediately.

Useful 0 Not Useful 0

Impact Analysis

If you have a WordPress site using WP Coder versions 4.0 to 4.5.1, an attacker with Editor-level access could fully compromise your site by executing malicious PHP code. This could lead to data theft, site defacement, or further attacks on your server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Compromised sites risk exposing sensitive user data, leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Coder plugin to version 4.5.2 or higher. If immediate update is not possible, restrict Editor role permissions or disable the plugin until patched. Monitor for unauthorized PHP code execution attempts.

Useful 0 Not Useful 0