An eval injection vulnerability in WordPress Coding Standards could allow attackers to execute arbitrary code if malicious configuration files are processed.

The software fails to properly neutralize directives within dynamically evaluated code, leading to a CWE-95 eval injection vulnerability. This allows an attacker to manipulate the execution flow of the coding standards tool.

While the attack requires user interaction, the potential impact includes full system compromise or code execution within the environment where the coding standards are applied. With a CVSS score of 8.6, this vulnerability represents a significant risk for development environments that rely on these standards for automated builds and testing.

Immediate Action: Update the WordPress-Coding-Standards package to version 3.4.1 or later via the appropriate package manager.

Proactive Monitoring: Monitor build pipelines and development server logs for any unexpected execution errors or unauthorized process spawns during code linting tasks.

Compensating Controls: Ensure that the coding standards tool is only executed in isolated, sandboxed environments with limited permissions.

Public Exploit Available: Unknown

Organizations utilizing these coding standards in their CI/CD pipelines should prioritize updating the package to version 3.4.1. This will eliminate the underlying eval injection flaw and secure the development infrastructure against potential compromise.