CVE-2026-8832

216.73.217.176

· Published 27/05/2026 08:16 · Modified 27/05/2026 14:50

Labels: CVE-2026-8832 2026-05-27 CVE-2026-8832 CWE-94 [email protected]

Essential information

Published: 27/05/2026 08:16
Modified: 27/05/2026 14:50
Author: —
Creator: —
CVSS: 8.8 HIGH (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS metrics

Description

The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capability_type or capability restrictions in the wpcode_register_post_type() function, allowing WordPress core to fall back to standard post capabilities for all creation paths including XML-RPC. This makes it possible for authenticated attackers, with author-level access and above, to create and publish executable PHP snippet posts via XML-RPC wp.newPost, which are then executed server-side via eval() in the run_eval() function when the snippet is rendered through the [wpcode] shortcode.

NVD status

Status: Deferred — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
wpcode / insert headers and footers	`cpe:2.3:a:wpcode:insert_headers_and_footers:2.3.5::::::wordpress::*`
wpcode / insert headers and footers	`cpe:2.3:a:wpcode:insert_headers_and_footers:::::::wordpress::`