CVE-2017-20251: WordPress Insert PHP Plugin < 2.5.1 PHP Code Injection via REST API
WordPress Insert PHP plugin versions before 2.5.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insertphp shortcodes to include and execute remote PHP files on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Insert PHP pluginto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20251?
CVE-2017-20251 has a critical severity rating of 9.8.
How do I fix CVE-2017-20251?
To fix CVE-2017-20251, update the WordPress Insert PHP plugin to version 3.3.1 or later.
What is the risk associated with CVE-2017-20251?
The risk associated with CVE-2017-20251 is high, with a risk score of 86.
Who is affected by CVE-2017-20251?
CVE-2017-20251 affects users of WordPress Insert PHP plugin versions before 3.3.1.
What type of vulnerability is CVE-2017-20251?
CVE-2017-20251 is a code injection vulnerability allowing arbitrary PHP code execution.