CVE-2017-20251
A critical vulnerability in the WordPress Insert PHP plugin allows attackers to run arbitrary PHP code without authentication. By sending specially crafted POST requests to the WordPress REST API, an attacker can inject malicious shortcodes that include and execute remote PHP files on the server. The flaw exists in plugin versions before 3.3.1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
WordPress Insert PHP plugin versions before 3.3.1. Users running the plugin on any WordPress site are affected.
Real-world impact
An attacker could run any PHP code on the server, potentially taking full control of the site, stealing data, or installing malware.
Why this severity
The CVSS score of 9.3 reflects the high impact of the vulnerability: it allows remote code execution with no authentication, giving attackers full control over the affected server.
What to do about it
- 01Upgrade the WordPress Insert PHP plugin to version 3.3.1 or later.
- 02Verify that the plugin has been updated to the latest version.
- 03Restart the WordPress site if necessary to apply the update.
NVD-referenced vendor advisory
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.