EUVD-2026-29034
GHSA-c697-h8w8-m356
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.
AnalysisAI
Remote code execution in the Custom css-js-php WordPress plugin versions up to 2.0.7 allows unauthenticated attackers to execute arbitrary PHP code on the server through SQL injection chained with PHP eval(). The plugin fails to sanitize user input before passing it to SQL queries, with query results subsequently executed via eval(). EPSS score of 0.02% (5th percentile) suggests low observed exploitation activity, and no public exploit code has been identified at time of analysis, though the technical barrier is low (CVSS AC:L/PR:N).
Technical ContextAI
This vulnerability exploits a classic injection-to-execution chain in WordPress plugin architecture. The Custom css-js-php plugin, designed to allow custom CSS/JavaScript/PHP code injection for site customization, fails to implement input validation on user-supplied data. Unsanitized input enters a SQL query construction path (SQL injection), and critically, the plugin then passes the SQL query results directly to PHP's eval() function-a dangerous practice that executes arbitrary code. This transforms a typical SQL injection (usually limited to database manipulation) into full remote code execution. The combination of SQL injection with eval() represents a severe architectural flaw, as eval() treats data as executable code. While no specific CWE was assigned, this maps to CWE-89 (SQL Injection) chained with CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code). The WordPress plugin ecosystem's PHP execution model makes eval() particularly dangerous, granting server-level code execution with web server privileges.
RemediationAI
Immediately remove or disable the Custom css-js-php plugin on all WordPress installations, as no patched version has been identified at time of analysis. Review WPScan advisory at https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/ and monitor vendor channels for patch announcements. If custom CSS/JS/PHP functionality is required, migrate to actively maintained alternatives like Simple Custom CSS and JS (by SilkyPress) or Code Snippets plugin, both of which implement proper input sanitization and avoid eval() usage. As compensating controls if immediate removal is not feasible: restrict WordPress admin dashboard access to specific IP addresses via web server configuration (.htaccess or nginx rules), implement web application firewall rules to block SQL injection patterns targeting plugin endpoints, enable WordPress security plugins with real-time malware scanning, and audit server logs for suspicious PHP execution or database queries. Note that WAF rules provide incomplete protection against SQL injection chained with eval() and should only be temporary measures-plugin removal remains the only definitive mitigation until a vendor patch is released and independently verified.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today