CVE-2026-3352: 
WordPress vulnerability analysis and mitigation

CVE-2026-3352 is a PHP Code Injection vulnerability in the Easy PHP Settings plugin for WordPress, affecting all versions up to and including 1.0.4. The flaw resides in the update_wp_memory_constants() method, which writes insufficiently validated user input to wp-config.php. It was published on March 7, 2026, and assigned a CVSS v3.1 base score of 7.2 (High), requiring Administrator-level authentication to exploit (Wordfence, ENISA EUVD).

The root cause is improper control of code generation (CWE-94): the plugin uses WordPress's sanitize_text_field() to sanitize the wp_memory_limit and wp_max_memory_limit settings, but this function does not strip single quotes. An attacker can supply a value containing a single quote to break out of the string context within a PHP define() statement in wp-config.php, injecting arbitrary PHP code that is then executed on every subsequent page request. The vulnerable code path is visible in the plugin source at class-easy-php-settings.php line 1800 (version 1.0.4), and was remediated in version 1.0.5 (Wordfence, WordPress Trac).

Successful exploitation grants the attacker full remote code execution on the web server, as the injected PHP code is written persistently to wp-config.php and executed on every page load. This results in complete compromise of confidentiality, integrity, and availability of the affected WordPress instance, including potential access to database credentials stored in wp-config.php, sensitive user data, and the ability to pivot to other systems accessible from the server (Wordfence, ENISA EUVD).

No public exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.045% (0.000450), indicating a low probability of near-term exploitation. Exploitation requires Administrator-level authentication, which significantly limits the attack surface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, ENISA EUVD).

1. Gain Administrator Access: Obtain WordPress Administrator credentials through phishing, credential stuffing, or by compromising another admin-level account on the target site.
2. Navigate to Plugin Settings: Log into the WordPress admin dashboard and navigate to the Easy PHP Settings plugin configuration page.
3. Craft Malicious Payload: Prepare a value for the wp_memory_limit or wp_max_memory_limit field that breaks out of the PHP string context, e.g.: 256M'); system($_GET['cmd']); define('DUMMY',' — this closes the existing define() call, injects a PHP function, and reopens a dummy define to maintain valid PHP syntax.
4. Submit the Settings: Save the settings, causing the plugin's update_wp_memory_constants() method to write the malicious payload directly into wp-config.php.
5. Trigger Code Execution: Any subsequent HTTP request to the WordPress site will load wp-config.php and execute the injected PHP code, enabling remote command execution (e.g., https://target.com/?cmd=id) (Wordfence, WordPress Trac).

• File System: Unexpected or modified content in wp-config.php, particularly within define('WP_MEMORY_LIMIT', ...) or define('WP_MAX_MEMORY_LIMIT', ...) lines containing PHP code, function calls, or single-quote anomalies; unexpected web shells or backdoor files in the WordPress root or plugin directories.
• Logs: WordPress admin action logs showing settings changes to the Easy PHP Settings plugin by an administrator account, especially from unusual IP addresses or at unusual times; PHP error logs showing parse errors or unexpected function calls originating from wp-config.php.
• Process: Unusual child processes spawned by the web server process (e.g., Apache or Nginx spawning bash, curl, wget, or python); unexpected outbound network connections from the web server.
• Network: Outbound connections from the web server to unknown external IPs; HTTP requests with command-injection-style query parameters (e.g., ?cmd=, ?exec=) to the WordPress site (Wordfence).

Update the Easy PHP Settings plugin to version 1.0.5 or later, which addresses the insufficient input validation by properly filtering single quotes before writing values to wp-config.php (WordPress Trac). If immediate upgrade is not possible, restrict Administrator access to trusted users only and monitor wp-config.php for unauthorized modifications. Site owners should also consider implementing file integrity monitoring on wp-config.php as a compensating control (Wordfence).

The vulnerability was reported by Wordfence, which assigned and disclosed the CVE. Automated CVE tracking accounts on Bluesky and Nitter/Twitter noted the disclosure shortly after publication. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator reporting (Wordfence).