Vulnerability-Lookup

GHSA-3PWP-G2MJ-5P3V

Vulnerability from github – Published: 2026-07-28 14:28 – Updated: 2026-07-28 14:28

Summary

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

Details

Impact

WordPress Coding Standards (WordPressCS) versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected.

The vulnerability happens when the sniff checks whether the $var argument passed to functions such as wp_enqueue_script() or wp_register_script() evaluates to a falsy value. The sniff's is_falsy() method reconstructed the argument and ran it through eval(). Because of this, a maliciously crafted $ver argument such as 'system'('id') would be executed during the scan.

Patches

This issue has been fixed in WordPressCS 3.4.1. We recommend all users upgrade to 3.4.1 or later.

Workaround

Users of the WordPress and WordPress-Extra rulesets, who cannot upgrade immediately, can disable the affected sniff by adding an <exclude> tag to their custom ruleset (the <rule> ref value might vary depending on the ruleset):

<rule ref="WordPress">
    <exclude name="WordPress.WP.EnqueuedResourceParameters"/>
</rule>

To verify that the sniff has been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. WordPress.WP.EnqueuedResourceParameters should no longer appear in the output under the WordPress section:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @FORIMOC for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the WPCS repository.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wp-coding-standards/wpcs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.14.1"
            },
            {
              "fixed": "3.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T14:28:12Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nWordPress Coding Standards (WordPressCS) versions before 3.4.1 contain an arbitrary code execution vulnerability in the `WordPress.WP.EnqueuedResourceParameters` sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.\n\nThis affects users of the `WordPress` and `WordPress-Extra` rulesets. The `WordPress-Core` ruleset and the `WordPress-Docs` ruleset are not affected.\n\nThe vulnerability happens when the sniff checks whether the `$var` argument passed to functions such as `wp_enqueue_script()` or `wp_register_script()` evaluates to a falsy value. The sniff\u0027s `is_falsy()` method reconstructed the argument and ran it through `eval()`. Because of this, a maliciously crafted `$ver` argument such as `\u0027system\u0027(\u0027id\u0027)` would be executed during the scan.\n\n### Patches\n\nThis issue has been fixed in WordPressCS 3.4.1. We recommend all users upgrade to 3.4.1 or later.\n\n### Workaround\n\nUsers of the `WordPress` and `WordPress-Extra` rulesets, who cannot upgrade immediately, can disable the affected sniff by adding an `\u003cexclude\u003e` tag to their custom ruleset (the `\u003crule\u003e` `ref` value might vary depending on the ruleset):\n\n```xml\n\u003crule ref=\"WordPress\"\u003e\n\t\u003cexclude name=\"WordPress.WP.EnqueuedResourceParameters\"/\u003e\n\u003c/rule\u003e\n```\n\nTo verify that the sniff has been disabled, run PHPCS with the `-e` flag, which lists all the sniffs a standard will run. `WordPress.WP.EnqueuedResourceParameters` should no longer appear in the output under the `WordPress` section:\n\n```\nphpcs -e --standard=/path/to/ruleset.xml\n```\n\n### Credits\n\nMany thanks to [@FORIMOC](https://github.com/FORIMOC) for responsibly disclosing this vulnerability.\n\n### How can I report a security bug?\n\nPlease report security vulnerabilities privately via [the \"Security and quality\" tab on the WPCS repository](https://github.com/WordPress/WordPress-Coding-Standards/security).",
  "id": "GHSA-3pwp-g2mj-5p3v",
  "modified": "2026-07-28T14:28:12Z",
  "published": "2026-07-28T14:28:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WordPress/WordPress-Coding-Standards/security/advisories/GHSA-3pwp-g2mj-5p3v"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WordPress/WordPress-Coding-Standards/pull/2771"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WordPress/WordPress-Coding-Standards/commit/a29048d0bbef5cf25d42349c74e4072d3cbc8325"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WordPress/WordPress-Coding-Standards"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WordPress/WordPress-Coding-Standards/releases/tag/3.4.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability"
}

CVE-2026-45293 (GCVE-0-2026-45293)

Vulnerability from cvelistv5 – Published: 2026-07-28 15:34 – Updated: 2026-07-29 13:47

Title

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

Summary

WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/WordPress/WordPress-Coding-Sta…	x_refsource_CONFIRM
https://github.com/WordPress/WordPress-Coding-Sta…	x_refsource_MISC
https://github.com/WordPress/WordPress-Coding-Sta…	x_refsource_MISC
https://github.com/WordPress/WordPress-Coding-Sta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
WordPress	WordPress-Coding-Standards	Affected: >= 0.14.1, < 3.4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45293",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T13:46:53.486331Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T13:47:28.857Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WordPress-Coding-Standards",
          "vendor": "WordPress",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.14.1, \u003c 3.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as \u0027system\u0027(\u0027id\u0027) would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T15:34:45.092Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WordPress/WordPress-Coding-Standards/security/advisories/GHSA-3pwp-g2mj-5p3v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WordPress/WordPress-Coding-Standards/security/advisories/GHSA-3pwp-g2mj-5p3v"
        },
        {
          "name": "https://github.com/WordPress/WordPress-Coding-Standards/pull/2771",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WordPress/WordPress-Coding-Standards/pull/2771"
        },
        {
          "name": "https://github.com/WordPress/WordPress-Coding-Standards/commit/a29048d0bbef5cf25d42349c74e4072d3cbc8325",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WordPress/WordPress-Coding-Standards/commit/a29048d0bbef5cf25d42349c74e4072d3cbc8325"
        },
        {
          "name": "https://github.com/WordPress/WordPress-Coding-Standards/releases/tag/3.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WordPress/WordPress-Coding-Standards/releases/tag/3.4.1"
        }
      ],
      "source": {
        "advisory": "GHSA-3pwp-g2mj-5p3v",
        "discovery": "UNKNOWN"
      },
      "title": "WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45293",
    "datePublished": "2026-07-28T15:34:45.092Z",
    "dateReserved": "2026-05-11T20:14:43.201Z",
    "dateUpdated": "2026-07-29T13:47:28.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted