WP Coder <= 4.5.1 - Authenticated (Editor+) Remote Code Execution via PHP Code Snippets
- ID
- WPSEC-2026-0381
- Plugin
- WP Coder – Insert & Manage Code Snippets (wp-coder)
- Affected
- from 4.0 before 4.5.2
- Remediation
- Update to 4.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- WP Coder on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-104677, on 2026-10-05.
Description
The WP Coder plugin for WordPress is vulnerable to Remote Code Execution in versions 4.0 through 4.5.1 because the plugin's admin pages and save handlers (Global PHP, code items containing PHP, tools, import/export and the debug log) were protected only by the 'unfiltered_html' capability instead of an administrator-level capability. On single-site installations, Editors hold 'unfiltered_html' by default. This makes it possible for authenticated attackers with Editor-level access and above to store PHP code that the plugin then executes on the server, giving them full control of the site.
References
- https://wpsec.com/vuln/WPSEC-2026-0381/
- https://plugins.svn.wordpress.org/wp-coder/tags/4.5.2/
- https://wordpress.org/plugins/wp-coder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS