CVE-2026-49774CWE-94

WordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability

Critical · published June 16, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion.

This issue affects RD Station: from n/a through 5.6.0.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00518 · 43.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-06-16T09:02Z
EPSS history
Timeline
  • 16 JUN 09:02Z
    WordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability
    cvelistv5