CVE-2026-49774: WordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability

Synopsis

A code injection vulnerability in the RD Station WordPress plugin (versions up to and including 5.6.0) allows a remote attacker with any low-privilege account to execute arbitrary code on the server. The vulnerability is reachable over the network, requires no victim interaction, and has a changed scope meaning exploitation can break out of the plugin's own security boundary to affect the broader WordPress environment. Successful exploitation gives the attacker full read, write, and availability control over the host. No fix has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress site over the network; no local or physical access is needed.

• AuthenticationRequired

  Any low-privilege WordPress account (such as a subscriber-level user) is sufficient; administrative credentials are not required.

• Victim interactionNot required

  No action from another user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout are required to achieve code execution.

Blast Radius

• The attacker executes arbitrary server-side code in the context of the web server process, enabling full control over the WordPress application.
• All data stored in the WordPress database, including user credentials, session tokens, and customer records, is readable by the attacker.
• The attacker can write, modify, or delete files on the server, including theme files, plugin files, and uploaded content.
• Because the scope is changed (S:C), the attacker can pivot beyond the plugin boundary to affect other applications or services sharing the same server environment.