PT-2026-57405 · WordPress · Code Engine

Published 2026-07-11 · Updated 2026-07-11 · CVE-2025-6784

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Code Engine plugin for WordPress versions prior to 0.3.6

Description Authenticated attackers with Contributor-level access and above can achieve Remote Code Execution (RCE) through the code-engine shortcode. This occurs because the plugin fails to restrict access to its code injection functionality, allowing the execution of arbitrary code on the server.

Recommendations Update the Code Engine plugin for WordPress to version 0.3.6 or later.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-6784

Affected Products

Code Engine

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-6784 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1a5f970a-e6a0-4dc7-8e99-342a32f5fd49?source=cve · Note
• https://twitter.com/infoflowcloud/status/2075871708234301930 · Twitter Post
• https://twitter.com/CVEnew/status/2075869787540881566 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3345666 · Note