Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the `update_wp_memory_constants()` method. This is due to insufficient input validation on the `wp_memory_limit` and `wp_max_memory_limit` settings before writing them to `wp-config.php`. The `sanitize_text_field()` function used for sanitization does not filter single quotes, allowing an attacker to break out of the string context in a PHP `define()` statement. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject and execute arbitrary PHP code on the server by modifying `wp-config.php`, which is loaded on every page request.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-07 | 2 | Disclosure1General1 |
| 2026-03-12 | 1 | Disclosure1 |
| 2026-05-12 | 2 | Disclosure2 |
Security alert: CVE-2026-3352 affects Easy PHP Settings <= 1.0.4. Plugin page: wordpress. org/plugins/easy-php-settings/WordPress. org lists 1,000+ active installations. https://t.co/zAq9kM7wD5
Post summary
The tweet announces a new CVE (2026-3352) affecting the Easy PHP Settings WordPress plugin, but provides no technical details, mitigations, or evidence of active exploitation.
ZAST engine verified CVE-2026-3352 in Easy PHP Settings <= 1.0.4. The bug path ends in attacker-controlled PHP written to wp-config.php. WordPress. org lists the plugin at 1,000+ active installations. https://t.co/6iB61J0SJ9
Post summary
The ZAST engine verifies CVE‑2026‑3352 in Easy PHP Settings versions <=1.0.4, where a flaw allows attacker‑controlled PHP to be written to wp‑config.php. With over 1,000 active installations, the vulnerability is potentially widely impactful.
CVE-2026-3352 (CVSS:7.2, HIGH) is Awaiting Analysis. The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0..https://nvd.nist.gov/vuln/detail/CVE-2026-3352 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE‑2026‑3352 as a PHP code injection flaw in the Easy PHP Settings plugin with a CVSS score of 7.2, noting it is awaiting analysis and linking to the NVD entry.
CVE-2026-3352 The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the `update_wp_memory_constants()` method… https://www.cve.org/CVERecord?id=CVE-2026-3352
Post summary
The Easy PHP Settings plugin for WordPress has a PHP code injection vulnerability (CVE-2026-3352) affecting versions up to 1.0.4 via the update_wp_memory_constants() method; no PoC, exploit code, patch, or active exploitation is mentioned.
CVE Alert: CVE-2026-3352 - shahadul878 - Easy PHP Settings - https://www.redpacketsecurity.com/cve-alert-cve-2026-3352-shahadul878-easy-php-settings/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-3352 #shahadul878 #easy-php-settings
Post summary
The tweet announces a CVE alert for CVE-2026-3352 but provides no technical, exploit, or mitigation details.