CVE-2026-45293 affects WPCS versions 0.14.1 through 3.4.0 in specific rulesets. Agencies and product teams often run different copies from project locks, global Composer installs, Docker images, reusable workflows, dependency proxies, IDE integrations, and developer machines.
Use this for WordPress plugin, theme, agency, marketplace, hosting, CI, and security teams that run PHPCS across several repositories or execution environments.
Quick answer
Inventory every place PHPCS executes, then record the requested constraint, locked version, runtime version, package path, cache key, image digest, active ruleset, and owner. Update to WPCS 3.4.1 or later, rebuild immutable environments, clear stale dependency caches, and verify `phpcs -e` in the actual job. Treat missing evidence as unverified, not compliant.
What to check first
- Search repository `composer.json` and `composer.lock`, monorepo packages, global Composer homes, dev containers, Dockerfiles, CI images, IDE settings, pre-commit hooks, and reusable workflows.
- Record project, branch, lock hash, constraint, locked WPCS, runtime WPCS, PHPCS, PHPCSUtils, PHPCSExtra, ruleset, image digest, cache key, and last execution time.
- Run `composer show --locked`, `composer show`, `phpcs --version`, `phpcs -i`, and `phpcs -e` inside the exact environment that scans code.
- Rebuild images and dependency caches from a clean base, then prove no older vendor tree or global binary wins path resolution.
- Assign every unverified laptop, archived pipeline, marketplace worker, and self-hosted runner to an owner and retirement or update date.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Inventory every scanner | Search repository `composer.json` and `composer.lock`, monorepo packages, global Composer homes, dev containers, Dockerfiles, CI images, IDE settings, pre-commit hooks, and reusable workflows. | Project lock, installed package, and runtime binary all agree. |
| Compare constraint, lock, and runtime | Record project, branch, lock hash, constraint, locked WPCS, runtime WPCS, PHPCS, PHPCSUtils, PHPCSExtra, ruleset, image digest, cache key, and last execution time. | Fresh container and cache builds resolve the corrected dependency set. |
| Update WPCS and compatible dependencies | Run `composer show --locked`, `composer show`, `phpcs --version`, `phpcs -i`, and `phpcs -e` inside the exact environment that scans code. | IDE, pre-commit, reusable workflow, and self-hosted runner paths are verified. |
| Rebuild images and caches | Rebuild images and dependency caches from a clean base, then prove no older vendor tree or global binary wins path resolution. | The fleet report has zero active unknown versions or unowned exceptions. |
Why this usually happens
- Composer constraints can allow a fixed version while the lock stays old.
- PATH can select a global PHPCS instead of the project binary.
- Container and CI cache layers can preserve an older vendor directory.
- Reusable workflows can resolve dependencies outside the application repository.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
composer show wp-coding-standards/wpcs --locked
composer show wp-coding-standards/wpcs
vendor/bin/phpcs --version
vendor/bin/phpcs -i
vendor/bin/phpcs -e | grep EnqueuedResourceParameters
# Record lock hash, image digest, cache key, ruleset, and runtime path.
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Inventory every scanner
- Compare constraint, lock, and runtime
- Update WPCS and compatible dependencies
- Rebuild images and caches
- Close every unverified environment
Decision rule
Pass when each active scanner reports WPCS 3.4.1 or later from the intended path, stale copies cannot execute, active rulesets are recorded, and every exception has an owner and deadline.
What to tell the client or owner
Give the owner the affected versions, exact workflow, observed result, business impact, evidence location, temporary control, named owner, and next review time. Remove credentials and personal data from shared screenshots and logs.
Production verification checklist
- Project lock, installed package, and runtime binary all agree.
- Fresh container and cache builds resolve the corrected dependency set.
- IDE, pre-commit, reusable workflow, and self-hosted runner paths are verified.
- The fleet report has zero active unknown versions or unowned exceptions.
Mistakes to avoid
- Do not change several plugins, cache rules, or infrastructure settings before preserving a baseline.
- Do not treat one successful test as proof for retries, alternate clients, background work, or mixed-version fleets.
- Do not paste secrets, personal data, complete production payloads, or customer files into tickets or screenshots.
- Do not close the test until the final user-visible state and the server-side evidence agree.
Questions teams ask during testing
Is changing `composer.json` enough?
No. Update the lock, install from it, rebuild cached environments, and verify the actual runtime binary.
What if the project uses WordPress-Core only?
The advisory says WordPress-Core and WordPress-Docs are not affected by the vulnerable sniff, but still record the ruleset and keep dependencies maintained.
When HandL WP should help
Bring in HandL WP when a production checkout, form, editor, security gate, media pipeline, or paid lead workflow is at risk. We can preserve evidence, isolate the failing layer, make the smallest corrective change, and verify the result across WordPress, connected services, logs, and the user journey.
If this is active on a production site, audit WordPress code scanners.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references