WordPress PHPCS WordPress-Extra Arbitrary Command Execution Vulnerability (CVE-2026-45283)

Vulnerability Overview Vulnerability ID: CVE-2026-45283 / GHSA-3xwp-g2mz-9p3y Vulnerability Type: Security Vulnerability Description: This vulnerability involves the function in , which uses to check for boolean false values. This approach poses a security risk that could lead to arbitrary command execution. Impact Scope Affected Components: WordPress and WordPress-Extra rule sets Affected Users: Users employing the WordPress and WordPress-Extra rule sets Affected Versions: Specific versions are not explicitly stated, but the vulnerability may be triggered during CI pipelines when processing pull requests or when reviewing third-party code on developer machines. Remediation Fix Details: Removed the call from and replaced it with explicit token-level checks to verify boolean false values. Fixed Logic: - Boolean false values - Integers or floats equal to zero - Text strings with content or (single-quoted, double-quoted, heredoc, or nowdoc) - Empty arrays Fixed Behavior: Other forms of falsy values (e.g., resulting from type casting) are no longer detected. Supporting these values does not cause errors but generates warnings instead. Updated Test Cases: Test case comments have been updated to reflect the new behavior. POC Code Suggested Changelog Entry SECURITY FIX: Unhandled PHP code encountered when running the WordPress-IP rule set (e.g., when triggering pull requests in a CI pipeline or reviewing third-party code on developer machines) could lead to arbitrary command execution. This fix affects users of the WordPress and WordPress-Extra rule sets. The WordPress-Core and WordPress-Bugs rule sets are not affected. Additional Information Labels: Component: Extra, Type: Bug Status: Merged Participants: 2 participants Milestone: 3.4.1

Goal Reached Thanks to every supporter — we hit 100%!

WordPress PHPCS WordPress-Extra Arbitrary Command Execution Vulnerability (CVE-2026-45283)

More from this source