High, CVSS 8.6PackagistAmendedPublished
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
CVE-2026-45293 · GHSA-3pwp-g2mj-5p3v
- Affected
- Packagist wp-coding-standards/wpcs >= 0.14.1, < 3.4.1
- Fixed in
- 3.4.1· Vendor fix available
- Issue
- Impact WordPress Coding Standards (WordPressCS) versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. The vulnerability happens when the sniff checks whether the $var argument passed to functions such as wpenqueuescript() or wpregisterscript() evaluates to a falsy value. The sniff's isfalsy() method reconstructed the argument and ran it through eval(). Because of this, a maliciously crafted $ver argument such as 'system'('id') would be executed during the scan. Patches This issue has been fixed in WordPressCS 3.4.1. We recommend all…
Recommended action: Upgrade to 3.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.