CVE-2025-6784

HIGH

Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-6784. PoCs published by incogbyte.

AI-analyzed exploit summary This PoC exploits CVE-2025-6784, a critical vulnerability in the WordPress Code Engine plugin (≤0.3.5) allowing Contributor+ users to execute arbitrary PHP via a crafted shortcode in a draft post preview. The exploit leverages missing capability checks during shortcode rendering when PHP blocks are enabled by an admin.

Description

The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Exploits (1)

github WORKING POC 5 stars
by incogbyte · pythonpoc
https://github.com/incogbyte/wp-cve-exploits/tree/main/CVE-2025-6784

This PoC exploits CVE-2025-6784, a critical vulnerability in the WordPress Code Engine plugin (≤0.3.5) allowing Contributor+ users to execute arbitrary PHP via a crafted shortcode in a draft post preview. The exploit leverages missing capability checks during shortcode rendering when PHP blocks are enabled by an admin.

Classification
Working Poc 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WordPress Code Engine plugin ≤0.3.5
Auth required
Prerequisites: Contributor+ credentials · Admin must have enabled PHP blocks (disallow_block_php=false) · Target must be running vulnerable plugin version (≤0.3.5)
mistral-large-3 · analyzed Jul 30, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0047
EPSS Percentile 38.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-77
Status published
Products (1)
tigroumeow/Code Engine – PHP Snippets, AI Functions & Automation for WordPress < 0.3.5
Published Jul 11, 2026
Tracked Since Jul 11, 2026