CVE-2026-104677 — WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role …
Published: 2026-10-07 · CVSS: 7.2 · CVSS 3.1
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7