SecurityOnlineDo Son
CVE-2026-45293 flaw in WordPressCS lets code run via PHP lint
Part of the CVE-2026-45293 story · since 29 Jul
Quiet for 13 weekslast report 29 Jul1 article1 outlet
- Wed 29 Jul, 08:15 UTC. SecurityOnline, first report. CVE-2026-45293 flaw in WordPressCS lets code run via PHP lint. This article, 1st of 1.
A significant vulnerability (CVE-2026-45293) in the WordPress Coding Standards (WordPressCS) allows arbitrary code execution when PHP code is linted using the tool. This flaw, rated 8.6 on the CVSS scale, affects versions between 0.14.1 and 3.4.1. The risk arises when untrusted PHP code is evaluated during scans, potentially leading to exploitation through compromised pull requests. While currently no confirmed exploit exists, it is advised that users upgrade to version 3.4.1 to mitigate the risk. The vulnerability affects only developers and CI systems that lint code.
How the story developed
Quiet for 13 weekslast report 29 Jul1 article1 outlet
1 article from 1 outlet since 29 Jul. Quiet since 29 Jul. This was the first report.
- Wed 29 Jul, 08:15 UTC. SecurityOnline, first report. CVE-2026-45293 flaw in WordPressCS lets code run via PHP lint. This article, 1st of 1.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 1 articles as a listHide the list
- Wed 29 JulDay 01
- CVE-2026-45293 flaw in WordPressCS lets code run via PHP lint08:15 · SecurityOnline · First report · This article, 1st of 1