Executive brief
The Custom css-js-php plugin for WordPress, which allows site administrators to add custom code snippets, contains a critical security flaw. An attacker can exploit this vulnerability to take complete control of the website without needing a username or password. This could lead to the theft of sensitive customer data, the defacement of the website, or the installation of malicious software on the server.
Technical details
The Custom css-js-php plugin (versions up to and including 2.0.7) fails to properly sanitize user-supplied input before incorporating it into a SQL query. Crucially, the results of this query are subsequently passed to the PHP eval() function. This chain allows an unauthenticated remote attacker to perform SQL injection to manipulate the query results, leading to arbitrary PHP code execution on the underlying server. The vulnerability is classified as CWE-94 (Code Injection) and CWE-89 (SQL Injection). As of the latest advisory, there is no known fix or patch available.
Affected products
- Custom css-js-php Custom css-js-php through 2.0.7
Timeline
- 2026-04-20: disclosed: Publicly published by WPScan
- 2026-05-11: advisory: CVE published to NVD dataset