CVE-2026-45293 Details
Description
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.
A vulnerability allowing arbitrary code execution exists in the WordPress Coding Standards (WordPressCS) PHP_CodeSniffer ruleset, specifically in versions 0.14.1 prior to 3.4.1. The issue arises within the WordPress.WP.EnqueuedResourceParameters sniff, which evaluates the $ver argument of functions like wp_enqueue_script() and wp_register_script() using eval(). This could lead to code execution, such as executing system commands, during a scan. The vulnerability is present when the sniff is applied to untrusted PHP code, for example, in a CI pipeline or while reviewing third-party code. Users of the WordPress and WordPress-Extra rulesets are affected, while the WordPress-Core and WordPress-Docs rulesets are not.
Users are advised to update WordPress Coding Standards to version 3.4.1 or later. Those who cannot upgrade immediately can disable the WordPress.WP.EnqueuedResourceParameters sniff in their custom ruleset.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |