CVE-2026-3352

The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the update_wp_memory_constants() method. This is due to insufficient input validation on the wp_memory_limit and wp_max_memory_limit settings before writing them to wp-config.php. The sanitize_text_field() function used for sanitization does not filter single quotes, allowing an attacker to break out of the string context in a PHP define() statement. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject and execute arbitrary PHP code on the server by modifying wp-config.php, which is loaded on every page request.

The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the update_wp_memory_constants() method. This is due to insufficient input validation on the wp_memory_limit and wp_max_memory_limit settings before writing them to wp-config.php. The sanitize_text_field() function used for sanitization does not filter single quotes, allowing an attacker to break out of the string context in a PHP define() statement. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject and execute arbitrary PHP code on the server by modifying wp-config.php, which is loaded on every page request.

The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the update_wp_memory_constants() method. This is due to insufficient input validation on the wp_memory_limit and wp_max_memory_limit settings before writing them to wp-config.php. The sanitize_text_field() function used for sanitization does not filter single quotes, allowing an attacker to break out of the string context in a PHP define() statement. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject and execute arbitrary PHP code on the server by modifying wp-config.php, which is loaded on every page request.

The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the update_wp_memory_constants() method. This is due to insufficient input validation on the wp_memory_limit and wp_max_memory_limit settings before writing them to wp-config.php. The sanitize_text_field() function used for sanitization does not filter single quotes, allowing an attacker to break out of the string context in a PHP define() statement. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject and execute arbitrary PHP code on the server by modifying wp-config.php, which is loaded on every page request.