WordPress Coding Standards – Code Injection (CVE-2026-45293)

Scope: WordPress Coding Standards (WordPressCS), Versions Prior to 3.4.2

Severity: Critical

A code injection vulnerability within the WordPress.WP.EnqueuedResourceParameters sniff of WordPressCS allows attackers to execute arbitrary code during the scanning process. The vulnerability occurs because the sniff reconstructs the ver argument of enqueued resource statements and passes it directly through the eval() function without proper sanitization. An attacker can weaponize this by embedding malicious PHP code into the ver parameter of a provided file. When a developer or automated CI/CD pipeline scans this file, the injected code executes on the scanning host with the privileges of the active user. This can lead to arbitrary command execution, theft of source code and sensitive credentials from developer workstations, unauthorized modification of build artifacts, or the deployment of ransomware across development infrastructure. Organizations must upgrade WordPress Coding Standards to version 3.4.2 or later immediately. If an immediate upgrade is not feasible, administrators should disable the WordPress.WP.EnqueuedResourceParameters sniff in their ruleset and ensure all security scans are executed within isolated, ephemeral containers to limit the potential blast radius.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the NVD Record for CVE-2026-45293 and apply the necessary updates.