WP Coder Plugin Allows Editor Role PHP Code Execution

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Coder WordPress plugin before version 4.5.2 contains a critical privilege escalation vulnerability that exposes a PHP code-execution feature to Editor-level users instead of restricting it to administrators only. By exploiting a content capability check rather than an admin-level gating mechanism, attackers with Editor credentials—a role commonly assigned to content creators and contributors—can execute arbitrary PHP code directly on the server. This results in complete site compromise, including potential data theft, malware installation, and lateral movement within the hosting environment. Any WordPress installation using this plugin with Editor users is at immediate risk, particularly multisite environments where multiple content creators may have access.

Casky's 323 mapped skills leverage Claude AI with extended reasoning to correlate privilege escalation patterns (MITRE TA0001) and code injection techniques (MITRE TA0043) across your infrastructure. Practitioners using Casky would identify suspicious activity through detection of unauthorized PHP execution initiated from Editor-level user sessions, unexpected administrative capability usage by non-admin roles, and post-exploitation behaviors like new user account creation or plugin installation attempts following editor-initiated PHP operations. The platform's skill-based analysis would surface the root cause—improper role-based access control (RBAC) enforcement—enabling teams to audit plugin configurations, review editor user permissions, and implement compensating controls while patches are deployed.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-104677.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-104677

Casky has 323 skills that investigate the attack patterns behind CVE-2026-104677. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn