CVE-2026-8832: WPCode WordPress Plugin RCE Vulnerability

CVE-2026-8832 Overview

CVE-2026-8832 is a Remote Code Execution (RCE) vulnerability in the WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress. The flaw affects all versions up to and including 2.3.5. The plugin registers the wpcode custom post type without a dedicated capability_type or capability restrictions, allowing WordPress core to fall back to standard post capabilities. Authenticated attackers with author-level access or higher can create executable PHP snippets through the XML-RPC wp.newPost endpoint. The snippets are then executed server-side via eval() when rendered through the [wpcode] shortcode. The issue is tracked as [CWE-94] Improper Control of Generation of Code.

Critical Impact

Authenticated authors can execute arbitrary PHP on the server, achieving full site compromise and a confidentiality, integrity, and availability breach.

Affected Products

• WPCode - Insert Headers and Footers + Custom Code Snippets plugin for WordPress, versions up to and including 2.3.5
• WordPress sites where the plugin is installed and active with author-level (or higher) user accounts
• Sites exposing XML-RPC (xmlrpc.php) endpoints to the network

Discovery Timeline

• 2026-05-27 - CVE-2026-8832 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8832

Vulnerability Analysis

The WPCode plugin stores PHP snippets as posts of a custom post type named wpcode. The post type is registered by the wpcode_register_post_type() function in includes/post-type.php. Because the registration call omits a custom capability_type and a capabilities map, WordPress applies the default capabilities used by ordinary posts. This means any role permitted to publish posts, including the built-in Author role, can also create and publish wpcode snippet posts.

The plugin renders snippets through the [wpcode] shortcode defined in includes/shortcode.php. When the shortcode is processed, the PHP snippet contents are passed to the run_eval() method in includes/execute/class-wpcode-snippet-execute-php.php, which invokes PHP's eval() on attacker-supplied code. The combination of permissive post creation and unrestricted code evaluation produces a reliable RCE primitive.

Root Cause

The root cause is missing capability restriction on the wpcode post type. By registering the post type without scoping creation to administrators, the plugin exposes a privileged code-execution surface to lower-privileged users. The secondary contributing factor is the use of eval() to run untrusted snippet content stored in the database without an out-of-band authorization check at render time.

Attack Vector

An authenticated attacker with author-level access authenticates to the XML-RPC interface and issues a wp.newPost call specifying post_type=wpcode with a PHP payload in the post content. The newly created snippet is then triggered by rendering the [wpcode] shortcode, at which point run_eval() executes the payload in the WordPress process context. Exploitation requires network access to xmlrpc.php and valid credentials, but does not require any user interaction.

No public proof-of-concept code has been published as of the data referenced in this article. Technical detail can be reviewed in the Wordfence Vulnerability Report and the WordPress Execute Snippet File.

Detection Methods for CVE-2026-8832

Indicators of Compromise

• POST requests to /xmlrpc.php containing wp.newPost method calls with post_type set to wpcode
• New rows in the wp_posts table where post_type = 'wpcode' created by users with the author role
• PHP processes spawned by the web server executing outbound network connections shortly after [wpcode] shortcode rendering
• Unexpected web shells, scheduled tasks, or modified plugin files appearing after publication of new wpcode snippets

Detection Strategies

• Inspect web server access logs for xmlrpc.php traffic from non-administrator accounts, correlated with HTTP 200 responses
• Audit the WordPress database for wpcode posts authored by non-administrator users and review their post_content for PHP code
• Alert on web-server-spawned php processes that initiate shell, network, or file-system actions inconsistent with normal request handling

Monitoring Recommendations

• Enable WordPress audit logging to record post creation, role usage, and XML-RPC method invocations
• Forward web server and PHP-FPM logs to a central analytics platform and search for the strings wp.newPost and post_type>wpcode
• Continuously inventory installed plugins and their versions to identify hosts still running WPCode 2.3.5 or earlier

How to Mitigate CVE-2026-8832

Immediate Actions Required

• Upgrade the WPCode - Insert Headers and Footers plugin to version 2.3.6 or later on all WordPress instances
• Audit the wp_posts table for wpcode entries created by non-administrator users and remove any unauthorized snippets
• Rotate credentials and review the user list for unexpected author-level or higher accounts that may have been provisioned by an attacker

Patch Information

The vendor addressed the issue in WPCode 2.3.6. The fix updates wpcode_register_post_type() to restrict creation of wpcode posts to administrators. Review the WordPress Changeset 3549060 and the full WordPress Version Change 2.3.5 to 2.3.6 for the upstream code change.

Workarounds

• Disable the WPCode plugin until the upgrade to 2.3.6 is verified across all sites
• Restrict access to xmlrpc.php at the web server or WAF layer, particularly for non-administrator users
• Downgrade or remove unnecessary author-level accounts and enforce least privilege on WordPress roles
• Block or monitor outbound network egress from the WordPress PHP process to limit post-exploitation impact

# Nginx example: block XML-RPC access from the network
location = /xmlrpc.php {
    deny all;
    return 403;
}

# WP-CLI: identify wpcode posts created by non-admin users
wp post list --post_type=wpcode --fields=ID,post_author,post_status,post_date

# WP-CLI: upgrade the plugin
wp plugin update insert-headers-and-footers --version=2.3.6