WordPressCS executes attacker-controlled PHP expressions during scans
WordPressCS from 0.14.1 through versions before 3.4.1 can execute code embedded in an untrusted PHP file being scanned. The WordPress.WP.EnqueuedResourceParameters sniff reconstructs the $ver argument passed to functions such as wp_enqueue_script() or wp_register_script() and sends it to eval() in is_falsy(); an attacker-controlled expression in that argument therefore executes on the CI runner or developer workstation running PHPCS. This is a local code-scanning issue rather than a WordPress HTTP endpoint and requires a developer or automated pipeline to scan the malicious file. The WordPress and WordPress-Extra rulesets are affected; WordPress-Core and WordPress-Docs are not.
- Component
- WordPress-Coding-Standards
- Plugin slug
- Not applicable
- Affected
- >= 0.14.1, < 3.4.1
- Safe version
3.4.1- Published
- Jul 28, 2026
Update, patch or deactivate.
Update wp-coding-standards/wpcs to 3.4.1 or later.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.
CVE / CNA vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H