Executive brief
The Insert PHP plugin (now known as Woody Code Snippets) for WordPress contains a critical security flaw that allows unauthorized individuals to run malicious code on a website. This plugin is typically used by site administrators to add custom scripts and logic without editing theme files. An attacker can exploit this to take full control of the website, steal sensitive data, or disrupt operations without needing a password or account.
Technical details
A PHP code injection vulnerability exists in the WordPress Insert PHP plugin (versions prior to 3.3.1) due to improper handling of shortcodes processed via the WordPress REST API. Unauthenticated attackers can exploit this by sending a specially crafted POST request to the 'wp-json/wp/v2/posts' endpoint. By including [insert_php] or [php] shortcodes within the request content, an attacker can force the server to execute arbitrary PHP code, such as including remote backdoor files. This vulnerability effectively allows remote code execution (RCE) on the underlying web server. The issue was addressed in version 3.3.1.
Affected products
- Themeisle Insert PHP (Woody Code Snippets) < 3.3.1
Timeline
- 2017-02-09: disclosed: Initial exploit and vulnerability details published by Sucuri and Exploit-DB
- 2017-02-09: patched: Plugin updated to version 3.3.1 to address the vulnerability
- 2026-06-09: advisory: NVD/VulnCheck published formal CVE record