The Easy PHP Settings plugin for WordPress contains a critical PHP code injection vulnerability that allows authenticated administrators to execute arbitrary code on the underlying server.

This flaw exists in the update_wp_memory_constants method, where improper sanitization of configuration inputs allows an authenticated administrator to break out of PHP string contexts. By injecting malicious payloads into the wp_memory_limit or wp_max_memory_limit settings, an attacker can modify the wp-config.php file to achieve remote code execution.

Successful exploitation of this vulnerability grants an attacker full control over the WordPress application and the associated server environment. Given the CVSS score of 7.2, this represents a high-severity risk that could lead to complete site compromise, data exfiltration, or the installation of persistent backdoors. Because the vulnerability affects a core configuration file, the impact on site availability and data integrity is total.

Immediate Action: Update the Easy PHP Settings plugin to version 1.0.5 or later, which includes the necessary sanitization patches.

Proactive Monitoring: Review the wp-config.php file for unauthorized modifications or unexpected PHP code blocks that do not align with standard WordPress configuration patterns.

Compensating Controls: Ensure that administrator accounts are restricted to trusted personnel and employ strong multi-factor authentication to prevent unauthorized users from accessing the administrative dashboard.

Public Exploit Available: No (exploit_available: false)

Organizations currently utilizing Easy PHP Settings must prioritize upgrading to version 1.0.5 immediately to remediate this vulnerability. Failure to patch allows any compromised or malicious administrator account to gain full system-level execution capabilities, effectively rendering the entire web server insecure.