PT-2026-65503 · WordPress · Wordpress-Coding-Standards

CVE-2026-45293 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress Coding Standards versions 0.14.1 through 3.4.0

Description An arbitrary code execution issue exists in the WordPress.WP.EnqueuedResourceParameters sniff, which is active in the WordPress and WordPress-Extra rulesets. The problem occurs when the is falsy() function reconstructs the $ver argument passed to functions such as wp enqueue script() or wp register script() and processes it using eval(). A maliciously crafted argument, such as 'system'('id'), can trigger arbitrary command execution on the scanning host when PHPCS is run over untrusted PHP code, such as in CI pipelines linting pull requests or during third-party code reviews.

Recommendations Update to version 3.4.1. As a temporary workaround, disable the WordPress.WP.EnqueuedResourceParameters sniff by adding an <exclude> tag to the custom ruleset.

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-45293

GHSA-3PWP-G2MJ-5P3V

Affected Products

Wordpress-Coding-Standards

References · 7

• https://osv.dev/vulnerability/GHSA-3pwp-g2mj-5p3v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45293 · Security Note
• https://github.com/WordPress/WordPress-Coding-Standards/commit/a29048d0bbef5cf25d42349c74e4072d3cbc8325 · Note
• https://github.com/WordPress/WordPress-Coding-Standards/releases/tag/3.4.1 · Note
• https://github.com/WordPress/WordPress-Coding-Standards/pull/2771 · Note
• https://github.com/WordPress/WordPress-Coding-Standards · Note
• https://github.com/WordPress/WordPress-Coding-Standards/security/advisories/GHSA-3pwp-g2mj-5p3v · Note