High severity8.8NVD Advisory· Published Jul 11, 2026· Updated Jul 13, 2026

CVE-2025-6784

Description

The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Code Enginellm-fuzzy
Range: <=0.3.5
Package: https://wordpress.org/plugins/code-engine

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3345666nvd
www.wordfence.com/threat-intel/vulnerabilities/id/1a5f970a-e6a0-4dc7-8e99-342a32f5fd49nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000