CVE-2026-3352
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the update_wp_memory_constants() method. This is due to insufficient input validation on the wp_memory_limit and wp_max_memory_limit settings before writing them to wp-config.php. The sanitize_text_field() function used for sanitization does not filter single quotes, allowing an attacker to break out of the string context in a PHP define() statement. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject and execute arbitrary PHP code on the server by modifying wp-config.php, which is loaded on every page request.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| shahadul878 | Easy PHP Settings | 0 <= 1.0.4 | affected |
Weaknesses
- CWE-94: CWE-94 Improper Control of Generation of Code ('Code Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f9927487-99fb-46d9-a208-f19e0a371267?source=cve
- https://plugins.trac.wordpress.org/browser/easy-php-settings/tags/1.0.4/class-easy-php-settings.php#L1800
- https://plugins.trac.wordpress.org/browser/easy-php-settings/trunk/class-easy-php-settings.php#L1800
- https://plugins.trac.wordpress.org/browser/easy-php-settings/tags/1.0.5/class-easy-php-settings.php#L1998
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.