PT-2026-33983 · Undefined · Undefined

John Umoru · Published 2026-04-21 · Updated 2026-05-16 · CVE-2026-6433

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Custom css-js-php versions prior to 2.0.8

Description The plugin fails to properly sanitize user input before incorporating it into a SQL query. The resulting output is then passed to the eval() function, which enables unauthenticated users to execute arbitrary PHP code on the server. This process involves a SQL injection (SQLi) leading to Remote Code Execution (RCE), where an attacker can run commands on the host operating system from a remote machine.

Recommendations Update to a version newer than 2.0.7.

Exploit

Fix

Related Identifiers

CVE-2026-6433

Affected Products

Undefined

References · 7

• 🔥 https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6433 · Security Note
• https://twitter.com/johnumorujo/status/2046524615921406066 · Twitter Post
• https://twitter.com/CVEnew/status/2053954500684071367 · Twitter Post
• https://t.me/cveNotify/162999 · Telegram Post
• https://t.me/CVEtracker/53352 · Telegram Post
• https://twitter.com/murrezsec/status/2055582646365827111 · Twitter Post