CVE-2017-20251 WordPress Insert PHP Plugin < 2.5.1 PHP Code Injection via REST API
CriticalCVSS 9.3
EPSS 0.56%
- Published
- Updated
- Exploit status
- No public exploit known
Description
WordPress Insert PHP plugin versions before 2.5.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| themeisle Woody Code Snippets | < 2.5.1 | 2.5.1 |
References
- ExploitDB-41308 exploit
- Official Product Homepage product
- VulnCheck Advisory: WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API third-party-advisory
- WordPress Changelog patch product