# CVE-2017-20251: WordPress Insert PHP plugin code injection via REST API

Source: https://junglewise.ai/threats/cve-2017-20251-wordpress-insert-php-plugin-code-injection-via-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2017-20251 · Severity: critical · CVSS 9.8 · Published 2026-06-09

The Insert PHP plugin (now known as Woody Code Snippets) for WordPress contains a critical security flaw that allows unauthorized individuals to run malicious code on a website. This plugin is typically used by site administrators to add custom scripts and logic without editing theme files. An attacker can exploit this to take full control of the website, steal sensitive data, or disrupt operations without needing a password or account.

Vendors: [Themeisle](https://junglewise.ai/threats/vendors/themeisle).

## Quick answers

**Is CVE-2017-20251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-20251 being exploited in the wild.

**How severe is CVE-2017-20251?** Critical severity, with a CVSS score of 9.8, published 9 June 2026.

**Which products and versions are affected?** Themeisle Woody Code Snippets < 3.3.1.

**Is there a fix for CVE-2017-20251?** A patch was published on 2017-02-09: Plugin updated to version 3.3.1 to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-20251 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2017-20251?** Check whether you run Themeisle Woody Code Snippets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A PHP code injection vulnerability exists in the WordPress Insert PHP plugin (versions prior to 3.3.1) due to improper handling of shortcodes processed via the WordPress REST API. Unauthenticated attackers can exploit this by sending a specially crafted POST request to the 'wp-json/wp/v2/posts' endpoint. By including [insert_php] or [php] shortcodes within the request content, an attacker can force the server to execute arbitrary PHP code, such as including remote backdoor files. This vulnerability effectively allows remote code execution (RCE) on the underlying web server. The issue was addressed in version 3.3.1.

## Affected products

- Themeisle Insert PHP (Woody Code Snippets) < 3.3.1

## Timeline

- 2017-02-09: disclosed: Initial exploit and vulnerability details published by Sucuri and Exploit-DB
- 2017-02-09: patched: Plugin updated to version 3.3.1 to address the vulnerability
- 2026-06-09: advisory: NVD/VulnCheck published formal CVE record

## References

- [https://fr.wordpress.org/plugins/insert-php/](https://fr.wordpress.org/plugins/insert-php/)
- [https://www.exploit-db.com/exploits/41308](https://www.exploit-db.com/exploits/41308)
- [https://www.vulncheck.com/advisories/wordpress-insert-php-plugin-php-code-injection-via-rest-api](https://www.vulncheck.com/advisories/wordpress-insert-php-plugin-php-code-injection-via-rest-api)