Read the docs
TI-2017-14315 Aliases CVE-2017-20251GHSA-mxq7-4xcj-jccm

WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API

Priority HIGH 81CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00559 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Woody Code Snippets (Themeisle): 3.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
themeisleWoody Code Snippetsbefore 3.3.13.3.1Patch availableCNA
  • Woody Code Snippets Vendorthemeisle Affected before 3.3.1 Fixed in 3.3.1 Patch available CNA

Remediation

  • Fix · CNA Woody Code Snippets (Themeisle) Fixed in 3.3.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-20251
  2. 2026-10-03 Alias added: GHSA-mxq7-4xcj-jccm
  3. 2026-10-29 Title updated · CNA

References

Exploit 1

Other 1

  • TI-2023-02146 Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization CVSS 3.1HIGH 8.8
  • TI-2023-20819 WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-12631 A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via… CVSS 3.1CRITICAL 10.0
  • TI-2023-02115 Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2022-04265 RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2023-01727 Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
See all 135 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences