CyberRota Analysis
AI-GeneratedThe vulnerability affects WordPress Coding Standards versions 0.14.1 to 3.4.1, specifically within the WordPress.WP.EnqueuedResourceParameters sniff, which improperly handles the $ver argument in functions like wp_enqueue_script(). This flaw allows for arbitrary command execution on the scanning host when running PHPCS with WordPressCS over untrusted PHP code, posing a significant risk to CI pipelines and environments that lint pull requests. Organizations using affected versions should prioritize updating to version 3.4.1 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.