Yongtae Jeon

**Name of the Vulnerable Software and Affected Versions** WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager versions prior to 2.3.6 **Description** Authenticated attackers with author-level access and above can achieve Remote Code Execution. The issue occurs because the `wpcode` custom post type is registered in the `wpcode register post type()` function without a custom `capability type` or capability restrictions, causing WordPress core to use standard post capabilities for creation paths, including XML-RPC. This allows attackers to create and publish executable PHP snippet posts using the XML-RPC `wp.newPost` endpoint. These snippets are subsequently executed server-side via the `eval()` function within the `run eval()` function when rendered through the `[wpcode]` shortcode. **Recommendations** Update to a version newer than 2.3.5.