Wordpress Coding Standards
Approved changes feed: RSS · Atom
cpe:2.3:a:wordpress:wordpress-coding-standards:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Wordpress (21977de4-0364-5ea6-90ad-48069434cf00) |
|---|---|
| Product | Wordpress Coding Standards (6baf7b99-f375-5a1c-9257-becda96d7d46) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-45293 |
vulnerable | 2026-09-16 04:33:58.553299 |
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
HIGH (8.6)
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.
Published: 2026-07-28T15:34:45.092Z
Updated: 2026-07-29T13:47:28.857Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.