Skip to content
fr Sign in
7.2 High

CVE-2026-104677 The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to…

Description

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.

Affected products and versions

Product Affected versions Fixed in
WP Coder 4.0 4.0 → < 4.5.2 4.5.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of WP Coder

The 2 CVEs of WP Coder →
CVE-2023-2362 The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress… 6.1 Medium
Track this CVE