CVE-2025-6784
published 2026-07-11CVE-2025-6784: The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This…
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.85%
56.5th percentile
The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
tigroumeow Code Engine Plugin up to 0.3.5 on WordPress Shortcode code-engine injection
vuldb·2026-07-11·CVSS 8.8
CVE-2025-6784 [HIGH] tigroumeow Code Engine Plugin up to 0.3.5 on WordPress Shortcode code-engine injection
A vulnerability was found in tigroumeow Code Engine Plugin up to 0.3.5 on WordPress. It has been declared as critical. This vulnerability affects the function code-engine of the component Shortcode Handler. The manipulation results in injection.
This vulnerability is cataloged as CVE-2025-6784. The attack may be launched remotely. There is no exploit available.
GHSA
The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode.
ghsa_unreviewed·2026-07-11
CVE-2025-6784 [HIGH] CWE-77 The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode.
The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-11
Published