CVE-2025-6784 PUBLISHED

Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution

Assigner: Wordfence
Reserved: 27.06.2025 Published: 11.07.2026 Updated: 11.07.2026

The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	tigroumeow
Product	Code Engine – PHP Snippets, AI Functions & Automation for WordPress
Versions	Default: unaffected affected from 0 to 0.3.5 (incl.)

Credits

Jonas Benjamin Friedli finder

References

Problem Types

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE