--- title: "Remote code execution (RCE)" description: "RCE explained: what remote code execution is, the flaws that lead to it, real WordPress and PHP examples and the settings that limit its impact." language: "en" locale: "en-US" type: "definition" canonical: "https://www.wp-masquerade.com/glossary/remote-code-execution/" published: "2026-10-28T08:00:00+00:00" modified: "2026-10-29T02:21:03+00:00" translations: en-US: "https://www.wp-masquerade.com/glossary/remote-code-execution/index.md" fr-FR: "https://www.wp-masquerade.com/fr/definitions/execution-de-code-a-distance/index.md" es-ES: "https://www.wp-masquerade.com/es/glosario/ejecucion-remota-de-codigo/index.md" de-DE: "https://www.wp-masquerade.com/de/glossar/remote-code-execution/index.md" it-IT: "https://www.wp-masquerade.com/it/glossario/esecuzione-remota-di-codice/index.md" pt-BR: "https://www.wp-masquerade.com/pt/glossario/execucao-remota-de-codigo/index.md" nl-NL: "https://www.wp-masquerade.com/nl/woordenlijst/remote-code-execution/index.md" --- # Remote code execution (RCE) Remote code execution (RCE) is a vulnerability that lets an attacker make a server run their own instructions over the network, without any legitimate access to it. It is one of the most severe types of vulnerability, because it often leads to a complete takeover of the site. RCE is rarely a vulnerability family on its own: it is the most serious outcome that several kinds of mistakes can lead to. Once an attacker gets PHP to run their code, they act with the site's privileges: they read `wp-config.php` and therefore the database credentials, create accounts, plant a [backdoor](https://www.wp-masquerade.com/glossary/backdoor/) or use the server to send spam. That is why unauthenticated RCE vulnerabilities almost always receive the highest severity scores. ## The paths that lead to RCE - **Code injection** (CWE-94): the program builds code from external data, for example with `eval()`. According to OWASP, the attacker is then limited only by what the language can do. - **Command injection**: data is passed to a system shell through `exec()`, `system()` or an equivalent. The attacker hijacks existing commands rather than writing PHP. - **File upload**: a form accepts a `.php` file and stores it in a folder reachable from the web. - **File inclusion** and **deserialization**: two mechanisms covered in the definitions of [file inclusion](https://www.wp-masquerade.com/glossary/file-inclusion/) and [insecure deserialization](https://www.wp-masquerade.com/glossary/insecure-deserialization/). - **Flaws in the language or the server**: PHP itself, or a system library it uses. ![Five-step RCE scenario through file upload: the attacker sends a .php file through a form that checks neither the type nor permissions, the plugin saves it in wp-content/uploads, the attacker requests its URL, PHP runs the code with the site's privileges, then the attacker installs a backdoor and an administrator account](https://www.wp-masquerade.com/media/2026/10/rce-televersement-en.webp) *The most common scenario on WordPress: a PHP file dropped where it should never be able to run.* ## Real-world examples - **WP File Manager, CVE-2020-25213**: before version 6.9, the plugin renamed an example file from the elFinder library with a `.php` extension, which allowed remote attackers to upload and run PHP code. CVSS 3.1 score: 10. - **PHP-CGI on Windows, CVE-2024-4577**: an argument injection caused by Windows character conversion, in PHP before 8.1.29, 8.2.20 and 8.3.8 running in CGI mode. [Our explanation of this PHP-CGI flaw](https://www.wp-masquerade.com/php-cgi-cve-2024-4577-windows-flaw/) specifies which servers were affected. - **glibc iconv, CVE-2024-2961**: a flaw in a system library, made exploitable through PHP, covered in [our article on the iconv vulnerability](https://www.wp-masquerade.com/glibc-iconv-cve-2024-2961-php-flaw/). *Video: “What is Remote Code Execution (RCE)?” (Indusface)* ## For WordPress: reducing the risk and the impact - Update plugins that handle files quickly (file managers, forms with attachments, import and export, backups). - Block PHP execution in `wp-content/uploads` at the web server level: that folder should only contain media. - Add `define( 'DISALLOW_FILE_EDIT', true );` to `wp-config.php` to disable the admin file editor. - Run a supported PHP version and ask your host how they handle `disable_functions` and `open_basedir`: hardening PHP limits what injected code can do. - A web application firewall blocks some known attempts, without replacing the update. WP Masquerade doesn't block RCE exploitation: it is neither a firewall nor an antivirus. After an intrusion, however, its [integrity check](https://www.wp-masquerade.com/features/wordpress-integrity-check/) flags modified, missing or unknown WordPress core files, one of the places where attackers hide their code. Plugin and theme files need to be checked by other means. ## Related terms - [File inclusion (LFI / RFI)](https://www.wp-masquerade.com/glossary/file-inclusion/) - [Insecure deserialization](https://www.wp-masquerade.com/glossary/insecure-deserialization/) - [Backdoor](https://www.wp-masquerade.com/glossary/backdoor/) - [WAF (web application firewall)](https://www.wp-masquerade.com/glossary/waf/) - [Malware](https://www.wp-masquerade.com/glossary/malware/) ## Sources - [MITRE CWE-94 : Improper Control of Generation of Code (Code Injection)](https://cwe.mitre.org/data/definitions/94.html) - [OWASP : Code Injection](https://community.owasp.org/attacks/Code_Injection) - [CVE Record : CVE-2020-25213](https://www.cve.org/CVERecord?id=CVE-2020-25213) - [CVE Record : CVE-2024-4577](https://www.cve.org/CVERecord?id=CVE-2024-4577)