CVE-2026-104677: unknown wp coder Code Injection
Vulnerability summary
CVE-2026-104677 is a high (CVSS 7.2) Code Injection vulnerability in unknown wp coder. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.4% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 4.5.2.
Timeline
- 07-10-2026PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
29%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- wp coder≥ 4.0, < 4.5.2
Wordpress1 product
- wp-coder≥ 4.0, ≤ 4.5.1 (fixed in 4.5.2)
2 vendors · 2 products