CVE-2026-45293High· 8.6▾ Twilight

WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score47/ 100 · Moderate

impact 47.3 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 28, 2026

Updated

Sep 9, 2026

CVSS

8.6

Vendor

wp-coding-standards

Product

wp-coding-standards/wpcs

CWE

CWE-95

Depth score

47 · Moderate

EPSS

0.25% · p16

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 30.

0.2% → 0.2%▲ 0.07%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 59 days

Jul 28, 2026Published
Disclosed via NVD
Jul 30, 2026EPSS first tracked
0.2%
Sep 9, 2026Record revised
Last analysed / modified upstream
Sep 25, 2026EPSS peak
0.2% → 0.2%

wp-coding-standards CWE-95 #nvd #ghsa #composer

Affected

wp-coding-standards/wpcs >= 0.14.1, < 3.4.1

Patched in

wp-coding-standards/wpcs 3.4.1

Full technical detail▾

Overview

WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-45293)

Affected packages:

wp-coding-standards/wpcs >= 0.14.1, < 3.4.1

Patched in:

wp-coding-standards/wpcs 3.4.1

Source: https://github.com/advisories/GHSA-3pwp-g2mj-5p3v

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#ghsa#composer

← Back to feed