WPCode < 2.3.6 - Author+ Remote Code Execution via XML-RPC wp.newPost

Description

The plugin registers the `wpcode` custom post type without a custom `capability_type` or capability restrictions in `wpcode_register_post_type()`, causing WordPress core to fall back to standard post capabilities for all creation paths including XML-RPC. This allows authenticated attackers with Author-level access and above to create and publish executable PHP snippet posts via the XML-RPC `wp.newPost` method, which are then executed server-side via `eval()` in `run_eval()` when the snippet is rendered through the `[wpcode]` shortcode.