CVE-2026-45293

What it is

WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.

At a glance

Exploitability

Can be exploited locally on the machine without logging in, but needs a user to act. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-28 16:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-24 13:10 UTC Last updatedMost recent change to the record

Details

Published

2026-07-28 16:18 UTC

Last modified

2026-10-24 13:10 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-95

Record status

Awaiting Analysis

Attack profile CVSS 3.1 · 8.6

Attack vector

Local

Complexity

Low

Privileges needed

None

User interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High