CVE-2025-6784 Overview
CVE-2025-6784 is a remote code execution vulnerability in the Code Engine plugin for WordPress. The flaw affects all versions up to and including 0.3.5. The vulnerability exists in the code-engine shortcode, which fails to restrict access to the plugin's code injection functionality. Authenticated users with Contributor-level access or higher can execute arbitrary code on the underlying server. The issue is classified under [CWE-77] (Improper Neutralization of Special Elements used in a Command).
Critical Impact
Authenticated Contributors can execute arbitrary code on the WordPress host, leading to full site compromise and potential lateral movement into the hosting environment.
Affected Products
- WordPress Code Engine plugin versions <= 0.3.5
- WordPress installations permitting Contributor-level registrations or higher
- Multisite deployments with the Code Engine plugin activated network-wide
Discovery Timeline
- 2026-07-11 - CVE-2025-6784 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2025-6784
Vulnerability Analysis
The Code Engine plugin exposes a shortcode named code-engine that renders and evaluates user-supplied code within WordPress posts and pages. The plugin does not verify whether the requesting user is authorized to invoke code-execution functionality when the shortcode is processed. As a result, any post author with the ability to insert shortcodes into content can trigger server-side code execution.
Contributor is the lowest WordPress role permitted to author content. Because Contributors can save drafts containing shortcodes and preview them, the attacker path does not require Editor or Administrator privileges. The impact spans confidentiality, integrity, and availability.
Root Cause
The root cause is a missing capability check on the shortcode handler. The plugin treats the presence of the code-engine shortcode inside content as sufficient authorization to run the embedded logic. It never validates the acting user's edit_others_posts or unfiltered_html capabilities before dispatching the code to the evaluation routine. This matches the [CWE-77] pattern of improper command neutralization.
Attack Vector
An attacker registers or compromises a Contributor account on a target WordPress site. The attacker creates a draft post containing the code-engine shortcode with a payload of their choice. When the shortcode is rendered — through preview, submission for review, or any front-end path that expands shortcodes — the payload executes in the PHP context of the web server. The attacker gains code execution as the WordPress process user and can pivot to database access, filesystem writes, and outbound network calls.
No verified proof-of-concept code is published. Refer to the Wordfence Vulnerability Report and the WordPress Changeset Update for authoritative technical details.
Detection Methods for CVE-2025-6784
Indicators of Compromise
- Draft or published posts containing the [code-engine] shortcode created by low-privileged users.
- New or modified PHP files in wp-content/uploads/ or plugin directories with recent timestamps.
- Unexpected outbound HTTP requests from the WordPress host to attacker-controlled infrastructure.
- WordPress user accounts recently promoted from Contributor to higher roles.
Detection Strategies
- Query the wp_posts table for post_content matching the pattern %[code-engine% and correlate with post_author role.
- Monitor web server access logs for POST requests to /wp-admin/post.php and admin-ajax.php from Contributor accounts followed by preview requests.
- Inspect the wp_options and wp_users tables for unauthorized privilege changes after suspicious post activity.
Monitoring Recommendations
- Enable PHP audit logging (disable_functions alerts, open_basedir violations) to catch anomalous runtime behavior.
- Alert on file integrity changes across wp-content/plugins/code-engine/ and the WordPress core directories.
- Baseline outbound network activity from the WordPress server and flag deviations to unfamiliar destinations.
How to Mitigate CVE-2025-6784
Immediate Actions Required
- Deactivate the Code Engine plugin on any site running version 0.3.5 or earlier until a fixed release is confirmed installed.
- Audit all Contributor, Author, and Editor accounts and remove any that are unrecognized or inactive.
- Review all posts and pages for the [code-engine] shortcode and remove instances authored by low-privileged users.
Patch Information
A plugin update is available via the WordPress Changeset Update. Update the Code Engine plugin to the latest version through the WordPress admin dashboard under Plugins → Installed Plugins. Verify the installed version is greater than 0.3.5 after the update completes.
Workarounds
- Restrict user registration and remove the ability for untrusted users to hold Contributor or higher roles.
- Deploy a Web Application Firewall (WAF) rule that blocks requests containing the code-engine shortcode from non-Administrator sessions.
- Enforce disable_functions in php.ini to remove exec, system, passthru, shell_exec, and eval where feasible.
# Configuration example: disable the plugin from the command line via WP-CLI
wp plugin deactivate code-engine
wp plugin update code-engine
wp user list --role=contributor --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
