CVE-2026-49774: RD Station RCE Vulnerability

CVE-2026-49774 Overview

CVE-2026-49774 is a code injection vulnerability in the Filipe Nasc RD Station WordPress plugin (integracao-rd-station). The flaw is classified under [CWE-94] Improper Control of Generation of Code. It affects all plugin versions up to and including 5.6.0. An attacker with low-privileged authenticated access can execute arbitrary code on the underlying web server. The vulnerability is reachable over the network with low attack complexity and results in a scope change, impacting confidentiality, integrity, and availability of the hosting environment.

Critical Impact
Authenticated attackers can achieve remote code execution on WordPress sites running the RD Station plugin through version 5.6.0, leading to full site compromise.

Affected Products

Filipe Nasc RD Station WordPress plugin (integracao-rd-station)
All versions from initial release through 5.6.0
WordPress sites with the RD Station integration plugin installed and active

Discovery Timeline

2026-06-16 - CVE-2026-49774 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49774

Vulnerability Analysis

The RD Station plugin fails to properly control how user-supplied input is incorporated into dynamically generated or executed code. This category of weakness, tracked as [CWE-94], allows an attacker to inject code constructs that the application later interprets and executes. The Patchstack advisory categorizes this issue as a Remote Code Execution (RCE) vulnerability and labels the attack pattern as Remote Code Inclusion.

Exploitation requires authenticated access, but only at a low privilege level. The attack vector is network-based, and the scope is changed, meaning impact extends beyond the vulnerable component to the broader WordPress installation and any data accessible to the PHP process. Successful exploitation grants the attacker the ability to execute arbitrary PHP, read or modify site content, pivot to other resources on the host, and persist within the environment.

The EPSS probability for this CVE is 0.408% as of 2026-06-18, placing it in the 32nd percentile of likelihood of exploitation activity. No public proof-of-concept or in-the-wild exploitation has been confirmed at the time of publication.

Root Cause

The root cause is improper neutralization of attacker-controlled input before it reaches a code execution sink. In WordPress plugin code, this pattern typically arises when input from request parameters is passed to constructs that evaluate strings as PHP code, included as a file path, or used to dynamically resolve callable functions without an allowlist. The plugin does not enforce sufficient validation or sanitization on these flows, permitting injected code to be executed by the PHP interpreter.

Attack Vector

An authenticated attacker sends a crafted HTTP request to a vulnerable endpoint exposed by the integracao-rd-station plugin. The request includes a payload that the plugin interprets as code or a file inclusion target. Once processed, the injected payload runs in the context of the PHP worker, granting the attacker the same privileges as the web server process. Refer to the Patchstack RCE Vulnerability Report for vendor-specific technical details.

Detection Methods for CVE-2026-49774

Indicators of Compromise

Unexpected PHP files written under wp-content/plugins/integracao-rd-station/ or wp-content/uploads/
Outbound network connections from the web server to unfamiliar hosts immediately after requests to RD Station plugin endpoints
New or modified WordPress administrator accounts created without a corresponding audit trail
Webshell artifacts or obfuscated PHP eval/base64_decode patterns in plugin or upload directories

Detection Strategies

Audit HTTP access logs for POST or GET requests to RD Station plugin endpoints containing serialized payloads, base64 strings, or PHP function names
Monitor for child processes spawned by the PHP-FPM or Apache worker, such as sh, bash, curl, or wget
Compare installed plugin file hashes against a known-good baseline from the WordPress plugin repository

Monitoring Recommendations

Enable WordPress audit logging to capture plugin file changes, option updates, and user role modifications
Forward web server and PHP error logs to a central SIEM and alert on anomalous code execution patterns
Track all authenticated sessions interacting with RD Station endpoints, particularly from low-privileged accounts

How to Mitigate CVE-2026-49774

Immediate Actions Required

Identify all WordPress sites running the integracao-rd-station plugin at version 5.6.0 or earlier
Deactivate and remove the plugin until a fixed version is confirmed available from the vendor
Rotate WordPress administrator passwords and invalidate active sessions for accounts that could reach plugin endpoints
Review the WordPress installation for webshells, unauthorized admin users, and modified core files

Patch Information

At the time of publication, the advisory lists affected versions through 5.6.0 with no fixed version specified. Monitor the Patchstack RCE Vulnerability Report and the official WordPress plugin repository for an updated release addressing CVE-2026-49774. Apply the patched version as soon as it is published by the vendor.

Workarounds

Remove or disable the RD Station plugin until a vendor patch is available
Restrict access to /wp-admin/ and plugin AJAX endpoints using IP allowlisting at the web server or WAF layer
Apply a virtual patch via a Web Application Firewall to block requests containing PHP code constructs or suspicious inclusion patterns targeting the plugin
Enforce least privilege on WordPress accounts so fewer users meet the authentication requirement for exploitation

bash

# Example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate integracao-rd-station
wp plugin delete integracao-rd-station