cve/cves/2026/CVE-2026-6433.md

CVE-2026-6433

Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE

Description

The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.

POC

Reference

• https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/

Github

• https://github.com/murrez/CVE-2026-6433

Nuclei

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-6433.yaml