{"id":"CVE-2026-45293","title":"WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions","summary":"WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rule…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-95"],"vendor":"wp-coding-standards","product":"wp-coding-standards/wpcs","affected":["wp-coding-standards/wpcs >= 0.14.1, < 3.4.1"],"patched":["wp-coding-standards/wpcs 3.4.1"],"published":"2026-07-28","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:50:00.950","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45293","references":[{"url":"https://github.com/WordPress/WordPress-Coding-Standards/commit/a29048d0bbef5cf25d42349c74e4072d3cbc8325","label":"security-advisories@github.com"},{"url":"https://github.com/WordPress/WordPress-Coding-Standards/pull/2771","label":"security-advisories@github.com"},{"url":"https://github.com/WordPress/WordPress-Coding-Standards/releases/tag/3.4.1","label":"security-advisories@github.com"},{"url":"https://github.com/WordPress/WordPress-Coding-Standards/security/advisories/GHSA-3pwp-g2mj-5p3v","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-3pwp-g2mj-5p3v"}],"tags":["nvd","ghsa","composer"],"epss":0.00184,"epssPercentile":0.0825,"aliases":["GHSA-3pwp-g2mj-5p3v"],"ecosystem":"composer","ingestedAt":"2026-07-28T14:36:39.093Z","slug":"CVE-2026-45293","body":"## Overview\n\nWordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-45293)\n\nAffected packages:\n\n- `wp-coding-standards/wpcs >= 0.14.1, < 3.4.1`\n\nPatched in:\n\n- `wp-coding-standards/wpcs 3.4.1`\n\nSource: https://github.com/advisories/GHSA-3pwp-g2mj-5p3v","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}