Skip to content

fix(CMS-3069): upgrade WPCS to 3.4.1 to close CVE-2026-45293 RCE - #378

Merged
fabianwgl merged 2 commits into
masterfrom
fix/CMS-3069-wpcs-3-4-1-security-upgrade
Sep 24, 2026
Merged

fix(CMS-3069): upgrade WPCS to 3.4.1 to close CVE-2026-45293 RCE#378
fabianwgl merged 2 commits into
masterfrom
fix/CMS-3069-wpcs-3-4-1-security-upgrade

Conversation

@fabianwgl

@fabianwgl fabianwgl commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Upgrades wp-coding-standards/wpcs 2.3.0 to 3.4.1 to clear CVE-2026-45293. There is no 2.x
backport, so the 3.x major upgrade is required.

JIRA: CMS-3069 (details and impact assessment there)

What changed

  • tests/composer.json: wpcs "*" to "^3.4.1"
  • tests/composer.lock: wpcs 3.4.1, php_codesniffer 3.13.6 (required by wpcs), plus new deps
    phpcsstandards/phpcsutils and phpcsstandards/phpcsextra
  • .phpcs.xml and .phpcs-security.xml: three required migrations for WPCS 3.x, see below

Ruleset migration, why each change is needed

  1. installed_paths gains phpcsutils and phpcsextra. WPCS 3 depends on both. The
    composer-installer normally auto-registers them, but these rulesets set installed_paths
    explicitly, which overrides that. Without this, phpcs errors with "referenced sniff not found".
  2. WordPress.WhiteSpace.PrecisionAlignment.Found renamed to Universal.WhiteSpace.PrecisionAlignment.Found.
    The sniff moved to PHPCSExtra in WPCS 3.0. The old exclude silently stops matching.
  3. blank_line_check property removed. It was dropped in WPCS 3.0 and now causes phpcs to
    error on an unknown property.

Checked against WPCS 3.4.1 and deliberately left alone: the YodaConditions.NotYoda exclude and
both WordPress.Files.FileName.* excludes are still valid.

dealerdirect/phpcodesniffer-composer-installer stays at ^0.7, tested as working with WPCS 3.4.1.

Draft: 34 lint violations still to fix

Baseline on master is 0 violations. This upgrade surfaces 34 new ones (17 errors, 17 warnings)
across 14 files, from sniffs added in WPCS 3.x / PHPCSExtra. phpcbf auto-fixes none of them.

Sniff Count
Generic.CodeAnalysis.RequireExplicitBooleanOperatorPrecedence.MissingParentheses 11
Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed 7
Universal.NamingConventions.NoReservedKeywordParameterNames.defaultFound 6
Universal.Namespaces.DisallowCurlyBraceSyntax.Forbidden 3
Universal.NamingConventions.NoReservedKeywordParameterNames.classFound 2
WordPress.WP.Capabilities.Unknown 2
PSR12.Files.FileHeader.IncorrectGrouping 1
PSR12.Files.FileHeader.IncorrectOrder 1
Universal.Files.SeparateFunctionsFromOO.Mixed 1

Please do not resolve these by weakening .phpcs-security.xml. That ruleset reports 0 violations
both before and after the upgrade.

Test plan

  • Resolves and installs on PHP 7.4
  • phpcs starts, resolves the Universal.* sniffs, no "referenced sniff not found"
  • .phpcs-security.xml clean (191 files, 0 violations)
  • Lint file coverage unchanged (same 236 files)
  • Fix or exclude the 34 new violations
  • Rebase after CMS-3070 merges, which removes the php_codesniffer hunk from this diff
  • CI PHP 7.4 Lint green

@fabianwgl
fabianwgl requested a review from apinto-uc September 21, 2026 13:57
@codeant-ai

codeant-ai Bot commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 CodeAnt AI — Review Status

Status Commit Started (UTC) Finished (UTC)
✅ Reviewed your PR 875553b Sep 21, 2026 · 13:57 14:00

@codeant-ai

codeant-ai Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

@codeant-ai codeant-ai Bot added the size:XS This PR changes 0-9 lines, ignoring generated files label Sep 21, 2026
@qodo-code-review

qodo-code-review Bot commented Sep 21, 2026

Copy link
Copy Markdown

PR Summary by Qodo

Upgrade WPCS to 3.4.1 for CVE-2026-45293 remediation

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

Grey Divider

AI Description 

• Upgrades WPCS to 3.4.1, remediating CVE-2026-45293 in CI linting.
• Refreshes PHPCS and required standards packages used by lint checks.
• Migrates PHPCS rulesets for compatibility with WPCS 3.
Diagram 

graph TD
  C["CI lint"] --> P["PHPCS 3.13.6"] --> R["PHPCS rulesets"] --> W["WPCS 3.4.1"] --> E["PHPCS Extra"] --> U["PHPCS Utils"]
Loading
High-Level Assessment

The direct dependency upgrade is the appropriate response to the reported vulnerability. Regenerating the lockfile and adapting both PHPCS rulesets keeps CI reproducible and compatible with WPCS 3; deferring the upgrade or suppressing affected checks would leave the vulnerable lint toolchain in place.

Files changed (4) +254 / -46

Other (4) +254 / -46
.phpcs-security.xmlRegister WPCS 3 support standards for security linting +1/-1

Register WPCS 3 support standards for security linting

• Adds PHPCSUtils and PHPCSExtra to the installed standards paths so the security-focused WPCS rules resolve under version 3.4.1.

.phpcs-security.xml

.phpcs.xmlAdapt the primary PHPCS ruleset for WPCS 3 +2/-7

Adapt the primary PHPCS ruleset for WPCS 3

• Registers PHPCSUtils and PHPCSExtra, switches the precision-alignment exclusion to its Universal sniff name, and removes the obsolete control-structure spacing customization.

.phpcs.xml

composer.jsonRequire the remediated WPCS release line +1/-1

Require the remediated WPCS release line

• Replaces the unrestricted WPCS development requirement with '^3.4.1', ensuring dependency resolution starts from the security-remediated release.

tests/composer.json

composer.lockLock the upgraded PHPCS and WPCS toolchain +250/-37

Lock the upgraded PHPCS and WPCS toolchain

• Locks WPCS 3.4.1 and PHPCS 3.13.6, adds PHPCSExtra 1.5.1 and PHPCSUtils 1.2.3, and refreshes Composer metadata. These resolved versions provide the updated CI lint dependency graph.

tests/composer.lock

@qodo-code-review

qodo-code-review Bot commented Sep 21, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Grey Divider

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Grey Divider

Tip of the day 
💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

@fabianwgl
fix(CMS-3069): resolve the 34 WPCS 3.4.1 lint violations
85d5bc4 
Fixes the 17 errors and 17 warnings surfaced by the WPCS 3.x upgrade,
verified clean with tests/vendor/bin/phpcs (0 errors, 0 warnings, 237
files) and tests/vendor/bin/phpcs --standard=.phpcs-security.xml
(0 violations, 192 files) in a PHP 7.4 Docker container.

- Universal.Namespaces.DisallowCurlyBraceSyntax: converted
  tests/helpers.php, src/lib/helper.php and src/addons/addons.php from
  brace to semicolon namespace syntax.
- PSR12.Files.FileHeader: moved the docblock above the namespace
  statement in tests/bootstrap.php, and merged the split use-statement
  groups in Support_Page.php (class uses, then function uses).
- Generic.CodeAnalysis.RequireExplicitBooleanOperatorPrecedence: added
  clarifying parentheses around mixed &&/|| expressions in
  general-page.php (cb_frame and uc_frame) and dashboard-page.php,
  same logic.
- Universal.NamingConventions.NoReservedKeywordParameterNames: renamed
  reserved-keyword parameters ($default -> $default_format/
  $default_value, $class -> $class_name) in Cookiebot_CLI_Command,
  Settings_Service(_Interface) and helper.php; all call sites use
  positional args so this is safe.
- Generic.CodeAnalysis.UnusedFunctionParameter: dropped the genuinely
  unused $assoc_args/$args from two WP-CLI command methods; suppressed
  the false positive on Base_Cookiebot_Addon::get_instance(), whose
  params are intentionally forwarded via func_get_args().
- Universal.Files.SeparateFunctionsFromOO: split the deprecated
  Cookiebot_WP class out of global-deprecations.php into its own
  global-deprecations-class.php (functions-only file left behind),
  required from cookiebot.php.
- WordPress.WP.Capabilities.Unknown: declared network_settings_page as
  a custom_capabilities entry in .phpcs.xml since it isn't a WordPress
  core capability (no behavior change).
@sonarqubecloud

sonarqubecloud Bot commented Sep 21, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
4.3% Duplication on New Code

See analysis details on SonarQube Cloud

@fabianwgl fabianwgl mentioned this pull request Sep 21, 2026
Merged
2 tasks done
apinto-uc
apinto-uc approved these changes Sep 23, 2026
View reviewed changes

@apinto-uc apinto-uc left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

@fabianwgl
fabianwgl merged commit b239786 into master Sep 24, 2026
11 checks passed
@fabianwgl fabianwgl mentioned this pull request Oct 6, 2026
Merged
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@apinto-uc apinto-uc apinto-uc approved these changes

Assignees

No one assigned

Labels

size:XS This PR changes 0-9 lines, ignoring generated files

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@fabianwgl @apinto-uc