CVE-2017-20251
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The WordPress Insert PHP plugin before version 3.3.1 contains a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.
Risk Assessment
The risk for the organization is critical because an unauthenticated attacker can take over the server, execute arbitrary PHP code, leading to data theft, malware installation, or complete site compromise.
Recommendation
Immediately update the Insert PHP plugin to version 3.3.1 or later. If an update is not possible, temporarily disable the plugin and remove all insert_php shortcodes from post content.
Original NVD description (English source)
WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.