WPCode EUVD-2026-32100

Exploitation requires an authenticated WordPress account with author-level capabilities or higher (CVSS PR:L), and the site's XML-RPC interface (xmlrpc.php / wp.newPost) must be reachable - the description specifically calls out XML-RPC as the creation path that bypasses the expected admin-only restriction. The malicious wpcode snippet must also be rendered through the [wpcode] shortcode for the eval() in run_eval() to fire. Limiting factors that reduce real-world risk: the attacker cannot exploit this unauthenticated (an author-or-higher credential is mandatory), so sites that tightly control author accounts, disable XML-RPC, or restrict who can publish are substantially harder to attack; no user interaction is required once the attacker has credentials and XML-RPC access. Affected configurations are any deployment running WPCode ≤ 2.3.5 with default capability handling.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high impact to confidentiality, integrity and availability - consistent with the description's claim that an author-level account yields server-side PHP execution. The EPSS score is low (0.44%, 63rd percentile), indicating no broad automated exploitation activity is currently observed, and the CVE is not listed in CISA KEV, so this is not confirmed actively exploited. No SSVC decision data was provided. The signals are coherent rather than conflicting: high technical impact and easy exploitation conditional on a single non-trivial prerequisite - the attacker must already hold author-or-higher credentials. That authentication requirement is what separates this from a wormable unauthenticated RCE and explains the modest EPSS. For sites with many lower-trust authors, contributors who have been elevated, or where author credentials can be obtained or guessed, this is a genuine high priority; for tightly controlled single-author sites the practical risk is lower but still significant given the trivial post-authentication path.

An attacker who controls or compromises an author-level WordPress account authenticates to the site's XML-RPC endpoint and calls wp.newPost to create and publish a 'wpcode' post whose body contains a malicious PHP payload. When that snippet is rendered via the [wpcode] shortcode, run_eval() passes the payload to eval(), executing the attacker's code server-side. The attack is network-based and low-complexity per CVSS, requiring no victim interaction; no public exploit is identified at time of analysis.