Executive brief
The Code Engine plugin for WordPress, which is used to run custom PHP code and automation on websites, contains a security flaw that allows users with basic contributor access to execute unauthorized code on the server. This could lead to a complete takeover of the website, theft of sensitive data, or the installation of malicious software. The issue stems from a lack of restrictions on who can use the plugin's code injection features via shortcodes.
Technical details
This vulnerability is classified as Remote Code Execution (RCE) via Command Injection (CWE-77). The root cause is the 'code-engine' shortcode failing to implement proper authorization checks or restrictions on the code injection functionality. An authenticated attacker with at least Contributor-level privileges can exploit this by embedding malicious code within a shortcode, which the plugin then executes on the server. The attack is reachable over the network and does not require user interaction beyond the attacker's own actions. A fix appears to be available in versions following 0.3.5, as indicated by the plugin's changeset history.
Affected products
- tigroumeow Code Engine – PHP Snippets, AI Functions & Automation for WordPress up to, and including, 0.3.5
Timeline
- 2026-07-11: advisory: NVD and Wordfence published the vulnerability details.
- 2026-07-11: disclosed