CVE-2026-45293 WordPress CVE debrief

Who should care

Defenders responsible for CI pipelines, developers reviewing third-party code, and teams using PHP_CodeSniffer with WordPressCS should assess exposure and apply patches or mitigations as needed.

Why it matters

A vulnerability in WordPress Coding Standards could allow arbitrary command execution on the scanning host when running PHPCS with WordPressCS over untrusted PHP, impacting CI pipelines and developers reviewing third-party code.

• Arbitrary command execution on the scanning host
• Potential for malicious code execution during PHPCS scans
• Need for verification of exposure in CI pipelines and developer environments
• Priority for patching or mitigating vulnerable WordPress Coding Standards versions

Technical summary

The WordPress.WP.EnqueuedResourceParameters sniff in WordPress Coding Standards reconstructs the $ver argument passed to functions like wp_enqueue_script() and runs it through eval() inside its is_falsy() method. A maliciously crafted argument can execute during a scan, leading to arbitrary command execution on the scanning host. This issue affects CI pipelines and developers reviewing third-party code. The vulnerability is fixed in version 3.4.1 of WordPress Coding Standards. Defenders should prioritize verifying exposure in CI pipelines and developer environments.

Defensive priority

Defenders should prioritize verifying exposure in CI pipelines and developer environments, and apply patches or mitigations as needed.

Recommended defensive actions

• Verify exposure in CI pipelines and developer environments
• Apply patches or mitigations as needed
• Monitor for suspicious activity in PHP_CodeSniffer scans
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in WordPress Coding Standards versions from 0.14.1 until 3.4.1, specifically in the WordPress.WP.EnqueuedResourceParameters sniff. The issue is fixed in version 3.4.1. Evidence is limited to public sources and vendor statements. Defenders should verify exposure in CI pipelines and developer environments with caution, considering potential limitations in available information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.