The WPCode plugin registers a custom post type named ‘wpcode’ without setting a custom capability_type or applying capability restrictions. This allows WordPress to use the default post capabilities for all creation paths, including XML‑RPC wp.newPost. An authenticated user who has author‑level access or higher can therefore create and publish PHP snippet posts via XML‑RPC. When a snippet is rendered through the [wpcode] shortcode, the plugin executes the PHP code server‑side using eval(), giving the attacker full remote code execution on the web server.

The vulnerability affects the WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager plugin for WordPress versions up to and including 2.3.5. Any site that has this plugin installed, allows author‑level or higher users to create snippets, and has the XML‑RPC endpoint enabled is susceptible. The issue does not affect other plugins or the WordPress core itself.

The CVSS score of 8.8 indicates a high severity vulnerability. An EPSS score is not available, so no current data on exploitation probability exists. The vulnerability is not listed in the CISA KEV catalog. The required foothold is an authenticated author‑level or higher user on a WordPress site with XML‑RPC enabled; if XML‑RPC is not exposed, the vector is mitigated. Given that the attack path is straightforward and only requires privileged user access, the risk is significant for sites that meet the conditions.