CVE-2026-45293: Arbitrary Code Execution in WordPress Coding Standards, a Tool With 49M+ Installs

TL;DR

A flaw in WordPress Coding Standards lets malicious PHP run code on the machine that lints it. Tracked as CVE-2026-45293, the bug carries a CVSS score of 8.6. The advisory calls it “an arbitrary code execution vulnerability” in one of the tool’s sniffs.

Why it matters

WordPress Coding Standards is a hugely popular developer tool. It has passed 49 million installs on Packagist. Because the bug fires during a code scan, a poisoned pull request could run commands inside a CI pipeline. That turns a routine lint step into a foothold.

One nuance matters here. This does not affect live WordPress websites. Only developers and CI systems that scan untrusted PHP are exposed. Even so, that scope still covers many open-source projects that lint contributor code automatically.

How the attack works

The problem sits in a single sniff that checks script version arguments. When it inspected that value, the sniff “reconstructed the argument and ran it through eval().” As a result, a crafted version value that resolves to a function call executes during the scan. Only the WordPress and WordPress-Extra rulesets trigger the flaw. The WordPress-Core and WordPress-Docs rulesets stay safe.

Affected versions

The issue affects WordPressCS versions before 3.4.1. Researcher @FORIMOC reported it responsibly. So far, no in-the-wild exploitation or public exploit has been confirmed.

Patch and mitigation

Upgrade without delay. The maintainers state, “We recommend all users upgrade to 3.4.1 or later.” If you cannot patch yet, exclude the affected sniff from your custom ruleset as a stopgap. Full details appear in the official GitHub security advisory for this WordPress Coding Standards vulnerability.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.