External risk intelligence

WordPress Insert PHP Plugin Unauthenticated PHP Code Injection via REST API

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2017-20251

The vulnerability exists in a WordPress plugin that processes requests through the WordPress REST API, which is a public-facing web endpoint designed to be accessible. Since it allows unauthenticated interaction with a core web service, it is highly likely to be reachable via the public internet in standard WordPress deployments.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a WordPress plugin could allow attackers to run custom code on your systems by sending specially crafted requests through the WordPress REST API. This could potentially lead to unauthorized access or control of your web environment.

Custom code could run on affected servers.
Remember: Remote code execution via public API.
Confirm if this plugin is in use.

Attack Path

How an attacker could exploit the issue

An attacker could begin by sending specially crafted POST requests to a publicly accessible WordPress REST API endpoint. This interaction aims to inject malicious shortcodes into content fields, which the vulnerable plugin then processes. When the plugin improperly handles these shortcodes, it can lead to the execution of arbitrary PHP code, potentially allowing remote file inclusion and server compromise.

Unauthenticated access to the REST API.
Injecting malicious shortcodes via API.
Arbitrary code execution and file inclusion.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could execute arbitrary PHP code on the server by injecting malicious shortcodes through the WordPress REST API. This could occur when POST requests are sent to the `wp-json/wp/v2/posts` endpoint with crafted content, potentially leading to the inclusion and execution of remote PHP files.

Arbitrary PHP code execution on server.
Malicious shortcodes via REST API.
Compromise of server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress Insert PHP plugin vulnerability requires immediate attention from teams managing WordPress deployments. Application owners are responsible for identifying all instances of this plugin within their managed WordPress sites. The initial practical step involves discovering where the affected plugin is deployed, determining its reachability, and assessing its criticality to business operations. Based on this risk assessment, a remediation plan can be developed in coordination with infrastructure and security teams.

Application owners and platform teams own this issue.
Verify plugin presence and reachability of REST API.
Plan and coordinate remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WordPress Insert PHP plugin?

The Insert PHP plugin is a tool for WordPress administrators that allows them to embed and run PHP code snippets directly within posts, pages, or widgets. It simplifies the process of adding custom server-side logic without needing to modify theme files. Because it gives users the ability to execute dynamic code, the plugin functions as a bridge between user-generated content and the underlying server environment.

What is the weakness behind CVE-2017-20251?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. In plain English, the plugin fails to sanitize user input before processing it. Because it treats incoming shortcodes as executable instructions, an attacker can supply their own PHP code instead of standard content. The system then inadvertently runs this injected code, granting the attacker the same capabilities as the server’s PHP interpreter.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a crafted POST request to the WordPress REST API, specifically targeting the post creation endpoint. The attacker does not need to log in or have existing permissions to do this. Simply browsing the site or viewing content does not trigger the bug; it requires active submission of malicious data through the API. The plugin then mistakenly interprets the injected shortcodes as legitimate commands to execute.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal labels this CVE as external because the WordPress REST API is a public-facing service by design. Since the vulnerability is reachable through this standard web endpoint, any WordPress installation with the API enabled and the plugin active is potentially exposed to the internet. This means the attack surface is not restricted to internal networks, making it accessible to anyone with network connectivity to the site.

Do I need to check my WordPress site for this plugin?

Yes, you should immediately inventory your WordPress deployments to see if you are running a version of the Insert PHP plugin earlier than 3.3.1. Confirm whether the REST API is enabled and if this specific plugin is installed. Once you have identified the locations of the affected software, coordinate with your technical team to prioritize removing or updating the plugin to eliminate the risk of unauthorized remote code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.