CVE-2026-8832

Name of the Vulnerable Software and Affected Versions WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager versions prior to 2.3.6

Description Authenticated attackers with author-level access and above can achieve Remote Code Execution. The issue occurs because the wpcode custom post type is registered in the wpcode register post type() function without a custom capability type or capability restrictions, causing WordPress core to use standard post capabilities for creation paths, including XML-RPC. This allows attackers to create and publish executable PHP snippet posts using the XML-RPC wp.newPost endpoint. These snippets are subsequently executed server-side via the eval() function within the run eval() function when rendered through the [wpcode] shortcode.

Recommendations Update to a version newer than 2.3.5.