CVE-2025-6784

Published Jul 11, 2026

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6784 is a Remote Code Execution (RCE) vulnerability found in the Code Engine plugin for WordPress, affecting all versions up to and including 0.3.5. The flaw arises because the plugin fails to restrict access to its code injecting functionality, which is accessible via the 'code-engine' shortcode. This vulnerability allows authenticated attackers, specifically those with Contributor-level access or higher, to execute arbitrary code on the server hosting the WordPress site. The underlying weakness is categorized as CWE-77, indicating an improper neutralization of special elements used in a command.

Description: The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Source: security@wordfence.com
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security@wordfence.com: CWE-77

Hype score: Not currently trending

References