CVE-2026-14900 is a 9.8 unauthenticated RCE in a WordPress plugin that provides a calculator builder feature. The root cause is straightforward: the plugin implements a js_tophp() function that converts JavaScript expressions to PHP for server-side evaluation, and this conversion relies on eval() with a regex-based alphanumeric allowlist. The regex permits only characters matching [a-zA-Z0-9]+, which the developer correctly identified as insufficient, leading to the addition of a nonce check. This nonce, however, is exposed in the page HTML via wp_head — the same mechanism WordPress uses for CSRF tokens — meaning it is trivially available to any unauthenticated visitor. The bypass uses XOR gadgets constructed from non-word characters to assemble payloads that bypass the alphanumeric filter while executing arbitrary PHP code through eval().
What makes this case instructive is the authentication failure pattern. The developer added a nonce check believing it provided access control, but WordPress nonces are CSRF tokens — they prove a request originated from a page on your site, not that the requester is authorized to perform the action. This is a category error that recurs across the WordPress plugin ecosystem, not a one-off mistake. The regex sanitization approach has also been bypassed repeatedly across template engines, SSTI contexts, and serialization gadget chains. These are known-failed patterns with a documented lineage dating back years.
If you're defending against this: patch immediately, as the CVSS indicates. But also audit your plugin inventory for any feature that uses eval() with any form of sanitization, regardless of whether a nonce check is present. The presence of a nonce check in WordPress plugins should never be treated as evidence of authentication — only as evidence that the developer attempted CSRF protection. The nonce-as-authentication anti-pattern is a structural vulnerability in how WordPress security guidance has been communicated to plugin developers, and it will produce more CVEs. Assume any eval()-based feature in a WordPress plugin is unauthenticated RCE until proven otherwise.