Summary
WordPress Coding Standards (WordPressCS) contained an eval injection flaw where a PHP_CodeSniffer sniff reconstructed user-provided arguments and executed them via eval() during static analysis.
When PHPCS with WordPressCS is run against untrusted PHP code, a crafted enqueued resource version parameter can trigger arbitrary command execution on the scanning host, turning the linting process itself into an attack vector.
WordPress Coding Standards (WordPressCS) contained an eval injection flaw where a PHP_CodeSniffer sniff reconstructed user-provided arguments and executed them via eval() during static analysis.
When PHPCS with WordPressCS is run against untrusted PHP code, a crafted enqueued resource version parameter can trigger arbitrary command execution on the scanning host, turning the linting process itself into an attack vector.
Affected context
This vulnerability occurs in environments where PHP_CodeSniffer is used together with WordPress Coding Standards versions 0.14.1 through 3.4.1, specifically with the WordPress or WordPress-Extra rulesets enabled.
It becomes relevant when scanning or linting PHP code that is not fully trusted—such as code in pull requests, third-party themes or plugins, or external contributions—because attacker-controlled arguments to WordPress enqueue functions are interpreted during the sniff's analysis.
This vulnerability occurs in environments where PHP_CodeSniffer is used together with WordPress Coding Standards versions 0.14.1 through 3.4.1, specifically with the WordPress or WordPress-Extra rulesets enabled.
It becomes relevant when scanning or linting PHP code that is not fully trusted—such as code in pull requests, third-party themes or plugins, or external contributions—because attacker-controlled arguments to WordPress enqueue functions are interpreted during the sniff's analysis.
Exploit preconditions
- Attack surface: The PHPCS/WordPressCS static analysis process on the machine performing code scans.
- Required access: Ability to submit or control PHP source code that will be scanned (e.g., via repository access, pull requests, or uploaded extensions).
- Trigger point: Execution of the WordPress.WP.EnqueuedResourceParameters sniff when it inspects calls like wp_enqueue_script() and processes their $ver parameter.
- Why exploitation is possible: The sniff reconstructs the $ver argument and passes it into eval() via the is_falsy() method, allowing attacker-controlled code to be evaluated on the scanning host outside of any runtime sandbox.
- Attack surface: The PHPCS/WordPressCS static analysis process on the machine performing code scans.
- Required access: Ability to submit or control PHP source code that will be scanned (e.g., via repository access, pull requests, or uploaded extensions).
- Trigger point: Execution of the WordPress.WP.EnqueuedResourceParameters sniff when it inspects calls like wp_enqueue_script() and processes their $ver parameter.
- Why exploitation is possible: The sniff reconstructs the $ver argument and passes it into eval() via the is_falsy() method, allowing attacker-controlled code to be evaluated on the scanning host outside of any runtime sandbox.
Why this happens
The underlying bug is the use of eval() on reconstructed data derived from analyzed source code within a static analysis tool.
Instead of treating the $ver argument as opaque or evaluating it in a controlled, non-executable manner, the sniff's is_falsy() logic directly executes the string as PHP, leading to CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code.
Conceptually, this represents an insecure pattern where analysis tooling treats user-supplied code as executable directives during inspection, giving attackers a way to break out of the "read-only" analysis context and run commands on the host.
The underlying bug is the use of eval() on reconstructed data derived from analyzed source code within a static analysis tool.
Instead of treating the $ver argument as opaque or evaluating it in a controlled, non-executable manner, the sniff's is_falsy() logic directly executes the string as PHP, leading to CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code.
Conceptually, this represents an insecure pattern where analysis tooling treats user-supplied code as executable directives during inspection, giving attackers a way to break out of the "read-only" analysis context and run commands on the host.
Potential impact
- Arbitrary command execution on machines running PHPCS with affected WordPressCS rulesets.
- Compromise of CI/CD pipeline runners that lint untrusted or contributed PHP code.
- Theft or modification of source code and secrets stored on the analysis host.
- Lateral movement from compromised build or review hosts into wider development infrastructure.
- Disruption of automated quality and security checks through sabotage of the scanning environment.
- Arbitrary command execution on machines running PHPCS with affected WordPressCS rulesets.
- Compromise of CI/CD pipeline runners that lint untrusted or contributed PHP code.
- Theft or modification of source code and secrets stored on the analysis host.
- Lateral movement from compromised build or review hosts into wider development infrastructure.
- Disruption of automated quality and security checks through sabotage of the scanning environment.
General mitigation guidance
Mitigation focuses on removing dynamic evaluation from analysis logic and tightening how static analysis tools interpret source code.
Secure patterns include:
- Avoiding eval() and similar dynamic execution primitives inside sniffs and code quality rules.
- Treating analyzed source as data only, and using parsers or abstract syntax trees rather than execution to reason about code behavior.
- Constraining what argument values are inspected and normalizing them safely instead of reconstructing and executing them.
- Running static analysis tools under least-privilege accounts and in isolated environments so that, even if a rule misbehaves, impact is limited.
- Establishing internal review and security checks for custom or third-party rulesets to detect unsafe execution patterns before deployment.
Mitigation focuses on removing dynamic evaluation from analysis logic and tightening how static analysis tools interpret source code.
Secure patterns include:
- Avoiding eval() and similar dynamic execution primitives inside sniffs and code quality rules.
- Treating analyzed source as data only, and using parsers or abstract syntax trees rather than execution to reason about code behavior.
- Constraining what argument values are inspected and normalizing them safely instead of reconstructing and executing them.
- Running static analysis tools under least-privilege accounts and in isolated environments so that, even if a rule misbehaves, impact is limited.
- Establishing internal review and security checks for custom or third-party rulesets to detect unsafe execution patterns before deployment.
How teams detect issues like this
Detection of this class of issue typically involves examining how analysis tooling handles user-controlled code and identifying dynamic execution paths.
Effective approaches include:
- Static analysis rules targeting eval(), create_function(), and similar constructs within sniffs, rulesets, or linters.
- Code review guidelines that flag any use of dynamic evaluation in tooling that processes untrusted input.
- Security testing of CI pipelines, including scanning linters and plugins as part of the supply chain rather than focusing solely on application code.
- Policy enforcement that restricts or forbids dynamic code execution in analysis environments, supported by automated tooling that scans for such patterns before new rulesets are adopted.
Detection of this class of issue typically involves examining how analysis tooling handles user-controlled code and identifying dynamic execution paths.
Effective approaches include:
- Static analysis rules targeting eval(), create_function(), and similar constructs within sniffs, rulesets, or linters.
- Code review guidelines that flag any use of dynamic evaluation in tooling that processes untrusted input.
- Security testing of CI pipelines, including scanning linters and plugins as part of the supply chain rather than focusing solely on application code.
- Policy enforcement that restricts or forbids dynamic code execution in analysis environments, supported by automated tooling that scans for such patterns before new rulesets are adopted.
