Update dependency wp-coding-standards/wpcs to v3.4.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
wp-coding-standards/wpcs	3.3.0 → 3.4.1

---

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

CVE-2026-45293 / GHSA-3pwp-g2mj-5p3v

More information

Details

Impact

WordPress Coding Standards (WordPressCS) versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected.

The vulnerability happens when the sniff checks whether the $var argument passed to functions such as wp_enqueue_script() or wp_register_script() evaluates to a falsy value. The sniff's is_falsy() method reconstructed the argument and ran it through eval(). Because of this, a maliciously crafted $ver argument such as 'system'('id') would be executed during the scan.

Patches

This issue has been fixed in WordPressCS 3.4.1. We recommend all users upgrade to 3.4.1 or later.

Workaround

Users of the WordPress and WordPress-Extra rulesets, who cannot upgrade immediately, can disable the affected sniff by adding an <exclude> tag to their custom ruleset (the <rule> ref value might vary depending on the ruleset):

<rule ref="WordPress">
	<exclude name="WordPress.WP.EnqueuedResourceParameters"/>
</rule>

To verify that the sniff has been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. WordPress.WP.EnqueuedResourceParameters should no longer appear in the output under the WordPress section:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @​FORIMOC for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the WPCS repository.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

• https://github.com/WordPress/WordPress-Coding-Standards/security/advisories/GHSA-3pwp-g2mj-5p3v
• https://github.com/WordPress/WordPress-Coding-Standards/pull/2771
• https://github.com/WordPress/WordPress-Coding-Standards/commit/a29048d0bbef5cf25d42349c74e4072d3cbc8325
• https://github.com/WordPress/WordPress-Coding-Standards/releases/tag/3.4.1
• https://github.com/advisories/GHSA-3pwp-g2mj-5p3v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

WordPress/WordPress-Coding-Standards (wp-coding-standards/wpcs)

v3.4.1

Compare Source

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

• The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #​2770
• The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #​2770
• Various housekeeping, including documentation improvements.

Fixed

• SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #​2771
  This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected.
  For more details, see the security advisory.
  Thanks to [@​FORIMOC] for responsibly disclosing the vulnerability.

v3.4.0

Compare Source

We're happy to welcome [@​rodrigoprimo] as co-maintainer of WordPressCS as of this release.

Added

• WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #​2696
• End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props [@​RafaelFunchal], [@​mattgaldino] and [@​rodrigoprimo], #​2489, #​2593, #​2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props [@​Nic-Sevic] and [@​rodrigoprimo], #​2488, #​2678), WordPress.DB.RestrictedClasses (props [@​paulgibbs] and [@​rodrigoprimo], #​2455, #​2689), WordPress.DB.DirectDatabaseQuery (props [@​jaymcp] and [@​rodrigoprimo], #​2458, #​2697), WordPress.DB.RestrictedFunctions (props [@​paulgibbs] and [@​rodrigoprimo], #​2453, #​2676), WordPress.DB.SlowDBQuery (props [@​petitphp] and [@​rodrigoprimo], #​2464, #​2699), WordPress.PHP.DevelopmentFunctions (props [@​gogdzl] and [@​rodrigoprimo], #​2490, #​2690), WordPress.PHP.NoSilencedErrors (props [@​gogdzl] and [@​rodrigoprimo], #​2495, #​2694), WordPress.PHP.PregQuoteDelimiter (props [@​tikifez] and [@​rodrigoprimo], #​2487, #​2677), WordPress.PHP.RestrictedPHPFunctions (props [@​gogdzl] and [@​rodrigoprimo], #​2491, #​2693), WordPress.Security.PluginMenuSlug (props [@​jasonkenison], #​2592), WordPress.WP.AlternativeFunctions (props [@​pamprn09], [@​bhubbard] and [@​rodrigoprimo], #​2496, #​2588, #​2687), WordPress.WP.DiscouragedConstants (props [@​RafaelFunchal], [@​paulopmt1] and [@​rodrigoprimo], #​2493, #​2589, #​2680), WordPress.WP.GlobalVariablesOverride (props [@​paulopmt1] and [@​rodrigoprimo], #​2586, #​2679).
  This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

• The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #​2761
• The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #​2761
• The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #​2757
• WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #​2747
• WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #​2747
• WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #​2747
• The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #​2579
• The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #​2706
  Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.
• WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #​2701
• Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #​2688
• Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #​2702
• Various housekeeping, including documentation and test improvements. Includes a contribution by [@​dd32].

Deprecated

• WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #​2696
  This is a name change only. The functionality of these properties is the same.

Fixed

• WordPress.DB.PreparedSQL and WordPress.DB.PreparedSQLPlaceholders: false positive for static method calls to a non-global class named wpdb. #​2753
• WordPress.Security.EscapeOutput: false positive for get_search_query() when the $escaped parameter was passed as fully qualified or non-lowercase true. #​2618
• WordPress.Security.EscapeOutput: false negative for _deprecated_file() calls when the basename( __FILE__ ) pattern used non-standard casing for either basename() and/or __FILE__. #​2729
• WordPress.WP.AlternativeFunctions: false negative when class functions/constants/properties use the same name as select global WP constants/functions. #​2617
• WordPress.WP.AlternativeFunctions: false positive for fully qualified references to the global PHP stream constants \STDIN, \STDOUT, and \STDERR. #​2617
• WordPress.WP.CronInterval: false positive when the callback function reference used a different case than the function declaration, even though they are in the same file. #​2730

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.