Loading story…
WordPress Coding Standards (WordPressCS) fixed CVE-2026-45293 / GHSA-3pwp-g2mj-5p3v, an arbitrary command-execution flaw in the WordPress.WP.EnqueuedResourceParameters sniff that affected versions 0.14.1 through 3.4.0. The bug stemmed from use of eval() in the is_falsy() method while reconstructing the $ver argument passed to functions such as wp_enqueue_script(), allowing crafted PHP like ('system')('id') in scanned code to execute commands on the machine running PHP_CodeSniffer. The risk is highest where untrusted PHP is linted in CI pipelines or reviewed on developer workstations.
The project released WordPressCS 3.4.1 and urged immediate upgrades, noting that the issue affects the WordPress and WordPress-Extra rulesets but not WordPress-Core or WordPress-Docs. The fix, merged in pull request #2771 and commit a29048d0bbef5cf25d42349c74e4072d3cbc8325, removes eval() and replaces it with explicit token-level checks for limited literal falsy values such as false, 0, '0', '', and empty arrays; maintainers also updated tests and raised minimum dependencies to PHPCSUtils 1.2.3 and PHPCSExtra 1.5.1.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-27, WordPress Coding Standards released version 3.4.1 as a security update and urged users to upgrade immediately. The release fixed the arbitrary command execution flaw affecting the WordPress and WordPress-Extra rulesets when scanning untrusted PHP code.
On 2026-07-27, WordPress Coding Standards merged pull request #2771 into develop to remove eval() from the is_falsy() logic in WP/EnqueuedResourceParameters. The patch replaced eval()-based handling with explicit token-level checks for limited falsy literal values.
WordPress Coding Standards credited FORIMOC for responsibly disclosing the vulnerability later tracked as CVE-2026-45293 / GHSA-3pwp-g2mj-5p3v. The issue affected the WordPress.WP.EnqueuedResourceParameters sniff and could lead to arbitrary command execution when scanning untrusted PHP code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released **7.0.4** as an emergency security update to fix an authenticated remote code execution flaw affecting sites that use **Imagick** with **Ghostscript** for media processing. The vulnerability, tracked as **`CVE-2026-65640`** and **`GHSA-8vr3-7mxf-gx8w`**, allows users with **Author-level or higher privileges** to upload a crafted file and trigger code execution during image handling, prompting WordPress to urge site owners to update immediately. Reports indicate the bug stemmed from a mismatch between WordPress file-type validation and how ImageMagick identifies content, allowing disguised **PostScript**, **EPS**, or malformed **PDF/polyglot** payloads to be processed as seemingly benign images such as PNG files. WordPress said the issue was responsibly reported by **pwn.ai** and patched by tightening inspection in `WP_Image_Editor_Imagick::load()`, blocking dangerous signatures and validating filenames and format prefixes; the fix is also being backported to the **4.7 branch** and included in **7.1 RC3**.
Aug 18, 2026
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 26, 2026
Two high-severity vulnerabilities have been disclosed in popular WordPress snippet-management plugins, exposing sites to **remote code execution** through `CWE-94` code injection flaws. `CVE-2026-25001` affects **Post Snippets** by Saad Iqbal in versions through `4.0.12`, while `CVE-2026-25366` affects **Woody ad snippets** (`insert-php`) by Themeisle in versions through `2.7.1`. Both issues were documented with Patchstack references and indicate that attackers could inject or include malicious code on vulnerable WordPress installations. The two CVEs differ in attack complexity but both carry severe impact to confidentiality, integrity, and availability. `CVE-2026-25001` is scored with `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`, while `CVE-2026-25366` carries `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, making the Woody ad snippets flaw easier to exploit once low privileges are obtained. Organizations running either plugin should identify affected versions, prioritize updates beyond the vulnerable releases, and review WordPress environments for signs of unauthorized code execution.
Jun 29, 2026