CVE-2009-2852: Ryan.mcgeary Wp-Syntax

Medium severity, CVSS 6.8. EPSS: 4.8% chance of exploitation in the next 30 days.

WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.

Affected products

• Ryan.mcgeary Wp-Syntax: up to and including 0.9.1

Published 2009-08-18. Last modified 2026-06-16.