What the vulnerability does
01Description
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.
Explanation of Vulnerability in Simple Terms
02Summary
WordPress Coding Standards plugin versions 0.14.1 through 3.4.0 contain an eval injection vulnerability. An attacker can craft a malicious file that, when processed by the plugin on a local system, executes arbitrary PHP code. This requires the victim to interact with the file (e.g., open or process it locally). The vulnerability can compromise confidentiality, integrity, and availability of the affected system.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on a local system processing the plugin's files.
Potential impact on your site
04Site Impact
If this plugin is used in a development or CI/CD environment, malicious files could execute code during code review or automated checks.
Conditions required to exploit
05Prerequisites
Local file access and user interaction to trigger file processing; no remote network access required.
Key dates
06Disclosure timeline
July 28, 2026
CVE published
July 29, 2026
Record updated
