{"id":"CVE-2026-104677","revision":"8eff3a6bbe3a482eafd9703b80794884","records":[{"revision":"8eff3a6bbe3a482eafd9703b80794884","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104677","aliases":[],"title":"WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP","description":"The WP Coder  WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.","state":0,"publishedAt":"2026-10-07T06:00:05.947+00:00","modifiedAt":"2026-10-07T09:56:37.022+00:00","affected":[{"ecosystem":"Vendor product","name":"WP Coder","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"WP Coder\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"4.0\",\n                            \"lessThan\": \"4.5.2\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/2e730bf3-ebf9-4c0d-bb05-8ca94c7cab60/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104677","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104677","identifiers":["CVE-2026-104677"]},"retained":false,"historicalAffected":[]}],"coverage":[]}