WordPress Coding Standards incorporates a PHP_CodeSniffer sniff, WordPress.WP.EnqueuedResourceParameters, which reconstructs the $ver argument for functions such as wp_enqueue_script() and passes it to an eval() call inside its is_falsy() method. A malformed argument such as 'system'('id') is therefore executed during a PHPCS scan. Because the scan can be performed against arbitrary PHP source in a CI pipeline or when a developer reviews third‑party code, an attacker who can influence the scanned code can trigger arbitrary command execution on the scanning host. The ability to execute arbitrary commands is a high‑impact vulnerability (CWE‑95).

The flaw exists in WordPress Coding Standards releases from 0.14.1 to 3.4.0 inclusive. The WordPress.Core and WordPress.Docs rulesets are not affected. The vulnerability was resolved in the 3.4.1 release, so any deployment of WordPress Coding Standards 0.14.1–3.4.0 is susceptible.

The CVSS score for this issue is 8.6, reflecting the high severity of arbitrary code execution. The EPSS score is less than 1 %, indicating a very low aggregated exploitation probability, and the vulnerability does not appear in the CISA KEV catalog. Exploitation requires the PHPCS tool to run with WordPressCS enabled against code that can be manipulated by an attacker, i.e., in environments where untrusted code is linted. While the threat window is limited, the impact of successful exploitation is severe because it compromises the host executing the scan.