CVE-2017-20251
Critical
Description
WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.
SeverityCritical
CVSS9.8
Exploit probability—
ProductWoody Code Snippets
PublishedJun 9, 2026
First seenJun 9, 2026
Weakness typeCWE-94Code injection
How to fix
Update
- Themeisle Woody Code Snippets3.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Themeisle Woody Code Snippets | v < 3.3.1 | 3.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.