CVE-2026-3352

The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the update_wp_memory_constants() method. This is due to insufficient input validation on the wp_memory_limit and wp_max_memory_limit settings before writing them to wp-config.php. The sanitize_text_field() function used for sanitization does not filter single quotes, allowing an attacker to break out of the string context in a PHP define() statement. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject and execute arbitrary PHP code on the server by modifying wp-config.php, which is loaded on every page request.