Security Alert Summary
The Custom css-js-php WordPress plugin through 2.0.7 contains a vulnerability where unsanitized user input is used in a SQL query and the query result is passed to eval(). This can allow unauthenticated users to execute arbitrary PHP code on the server.
CVE Details
- CVE ID: CVE-2026-6433
- Affected component: Custom css-js-php WordPress plugin
- Affected versions: through 2.0.7
- Published: May 11, 2026 at 06:16:09 AM UTC
- Last modified: May 11, 2026 at 06:16:09 AM UTC
- CVSS v3.1: Not provided
- Authentication required: None – the issue can be triggered by unauthenticated users (as stated in the description)
- Privileges required: None
- User interaction: None required
- Primary impact:
- Confidentiality: High – arbitrary code execution can allow access to sensitive data.
- Integrity: High – arbitrary code execution can modify site files or database content.
- Availability: High – arbitrary code execution can disrupt site operation.
- CWE / weakness ID: Not specified
Technical Details
According to the provided description, the plugin fails to properly sanitize user-supplied input before incorporating it into a SQL query. The result of that query is then passed to eval(). Because eval() executes PHP code contained in a string, an attacker who can influence the SQL result can execute arbitrary PHP on the server.
The description does not name specific functions, hooks, REST API endpoints, or code locations. Based only on the provided information, the root cause is the combination of:
- Insufficient input sanitization prior to database usage
- Use of
eval()on data that can be influenced by external input
The practical impact is that unauthenticated attackers may be able to run PHP code in the site environment, which can be used to read or modify data, create or alter accounts, or run arbitrary commands permitted by the PHP process. The exact scope depends on the site configuration and server permissions; this description does not provide exploit details or confirmation of active exploitation.
How This Could Impact Your Website
Imagine a typical small organization with a site owner, internal staff (editors and contributors), and occasional external contractors who submit content. An unauthenticated attacker exploiting this issue could execute PHP code that reads the database or filesystem. This could expose internal user email addresses and other data stored on the site.
Exposure of email addresses or other user data increases the risk of targeted phishing or social-engineering attacks against staff and contractors. An attacker with the ability to execute PHP could also modify posts, inject malicious content, or perform actions that affect site availability. The description does not state that full platform takeover is guaranteed, but arbitrary code execution materially increases risk to confidentiality, integrity, and availability.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other roles with content submission privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected PHP files, new admin accounts, or suspicious database queries.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
