CVE-2026-3352 Details
Description
The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the `update_wp_memory_constants()` method. This is due to insufficient input validation on the `wp_memory_limit` and `wp_max_memory_limit` settings before writing them to `wp-config.php`. The `sanitize_text_field()` function used for sanitization does not filter single quotes, allowing an attacker to break out of the string context in a PHP `define()` statement. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject and execute arbitrary PHP code on the server by modifying `wp-config.php`, which is loaded on every page request.
A PHP code injection vulnerability exists in the Easy PHP Settings WordPress plugin, affecting all versions up to and including 1.0.4. The issue arises in the 'update_wp_memory_constants()' method, where the 'wp_memory_limit' and 'wp_max_memory_limit' settings are inadequately validated before being written to 'wp-config.php'. The sanitization function 'sanitize_text_field()' fails to remove single quotes, enabling an attacker to escape the string context in a PHP 'define()' statement. This vulnerability allows authenticated attackers with Administrator-level access to inject and execute arbitrary PHP code on the server by altering 'wp-config.php', a file that is loaded with every page request.
Users are advised to update the Easy PHP Settings WordPress plugin to version 1.0.5 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 7, 2026CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Easy PHP Settings | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 7, 2026 | New CVE Received | [email protected] |