Executive brief
WPCode is a popular WordPress plugin used to manage and inject custom code snippets into websites. A security flaw allows users with 'author' level permissions or higher to bypass intended restrictions and upload malicious PHP code. If exploited, an attacker can take full control of the website and the underlying server, potentially leading to data theft or complete service disruption.
Technical details
The WPCode plugin for WordPress is vulnerable to Remote Code Execution in versions up to 2.3.5. The root cause is the 'wpcode' custom post type being registered in the wpcode_register_post_type() function without a specific capability_type or explicit capability restrictions. This allows the WordPress core to default to standard post capabilities, enabling authenticated attackers with author-level access to create and publish PHP snippet posts via the XML-RPC wp.newPost method. These snippets are subsequently executed server-side using eval() within the run_eval() function when rendered via the [wpcode] shortcode. The issue is addressed in version 2.3.6.
Affected products
- WPCode WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager Up to and including 2.3.5
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
References
- https://plugins.trac.wordpress.org/browser/insert-headers-and-footers/tags/2.3.5/includes/class-wpcode-snippet-execute.php
- https://plugins.trac.wordpress.org/browser/insert-headers-and-footers/tags/2.3.5/includes/class-wpcode-snippet-execute.php
- https://plugins.trac.wordpress.org/browser/insert-headers-and-footers/tags/2.3.5/includes/execute/class-wpcode-snippet-execute-php.php
- https://plugins.trac.wordpress.org/browser/insert-headers-and-footers/tags/2.3.5/includes/post-type.php
- https://plugins.trac.wordpress.org/browser/insert-headers-and-footers/tags/2.3.5/includes/shortcode.php
- https://plugins.trac.wordpress.org/changeset/3549060/insert-headers-and-footers/trunk/includes/post-type.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Finsert-headers-and-footers/tags/2.3.5&new_path=%2Finsert-headers-and-footers/tags/2.3.6