Remote Code Execution in WordPress, Explained
The worst class, how plugins get there, and why cleanup is not the same as patching.
Remote code execution means an attacker runs their own code on your server. Everything else on the severity scale is a step towards this one.
How WordPress plugins get there
- Unrestricted file upload — a handler that accepts a file and puts it somewhere the web server will execute. The most common route by far.
- Unsafe deserialisation — reconstructing objects from attacker-controlled data.
- Dynamic includes — a file path taken from the request.
- Chained flaws — a CSRF or an injection that reaches functionality capable of writing PHP.
Why an upload bug is so often the whole story
Validating an upload correctly means checking the extension, the reported type, the actual content, and the destination path — and then storing the file somewhere PHP will not run it. Plugins routinely get three of those right. The Ninja Forms File Uploads flaw disclosed in 2026 (CVE-2026-0740, CVSS 9.8) is a textbook case: the handler validated the source filename but not the destination, so the allowlist could be bypassed. Even the initial patch was incomplete.
Once code has run on your server, patching the plugin does not undo it. Assume persistence — added accounts, modified files, scheduled tasks, credentials copied — and clean accordingly.
Responding to an RCE finding
- Patch or remove the component immediately. If it is active and a public exploit exists, take the site offline rather than leave it up while you think.
- Assume compromise if the vulnerable version was exposed. Look for web shells in upload directories, unexpected admin users, and unfamiliar cron entries.
- Rotate everything: WordPress admin passwords, database credentials, hosting and FTP/SSH credentials, API keys.
- Find the entry point before restoring, or you will restore the hole with the site. See how to clean an infected WordPress website.
If that is more than you want to handle, WPDeeply offers emergency repair.
Want this checked automatically across every plugin, theme and core file on your site? WPDeeply Risk Monitor is free.
