Security readout for executives and security teams
Plain-English summary
This vulnerability can let an unauthenticated attacker run PHP on a WordPress server through a vulnerable Insert PHP-related plugin. If exploitable, it can lead to full site compromise, data theft, defacement, malware hosting, or service disruption. The source data has naming and version inconsistencies, so affected installations need careful confirmation.
Executive priority
Treat this as urgent for exposed WordPress properties. The potential impact is full server-side code execution, and public exploit information exists. Prioritize confirmation and containment over debate because the source bundle has inconsistent product metadata.
Technical view
The bundle describes CWE-94 PHP code injection through WordPress REST API post content using insert_php shortcodes. It is rated CVSS 9.8 with network access, no privileges, and no user interaction. Sources cite public exploit material, but KEV is false and active exploitation is not confirmed.
Likely exposure
Exposure is likely limited to WordPress sites running the referenced Insert PHP or Woody Code Snippets plugin in affected versions. The supplied affected-product data conflicts with the narrative, so inventory should check both plugin names and vendor guidance.
Exploitation context
A public ExploitDB reference exists, which raises practical risk. The provided sources do not establish active exploitation in the wild. The described attack path is unauthenticated and remote, making internet-facing WordPress sites the priority.
Researcher notes
Key uncertainty: the bundle references Insert PHP, Woody Code Snippets, versions before 3.3.1, and 4.7.0 in conflicting ways. Validate against CVE, VulnCheck, and vendor pages before scoping solely by CPE or version.
Mitigation direction
- Inventory WordPress sites for Insert PHP and Woody Code Snippets plugin usage.
- Disable or remove affected plugin installations until vendor status is confirmed.
- Update to a vendor-supported non-vulnerable version when available.
- Review vendor and VulnCheck guidance before relying on version data alone.
- Prioritize internet-facing WordPress sites and business-critical properties first.
Validation and detection
- Confirm installed plugin names, slugs, vendors, and versions across WordPress assets.
- Review logs for unexpected POST activity to WordPress REST post endpoints.
- Search content for unexpected insert_php shortcode usage.
- Check file integrity for unauthorized PHP changes or new web-accessible files.
- Verify remediation by confirming the plugin is removed, disabled, or safely updated.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2017-20251 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-41308CVE reference, VulnCheck · exploit
- Official Product HomepageCVE reference, VulnCheck · product
- VulnCheck Advisory: WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST APICVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.