Skip to content
Threat Feed
Subscribe

Product

Insert PHP Plugin < 3.3.1 (< 3.3.1)

1 brief RSS
critical advisory

WordPress Insert PHP Plugin RCE (CVE-2017-20251)

An unauthenticated remote code execution vulnerability (CVE-2024-XXXX, CVE-2017-20251) in WordPress Insert PHP plugin versions before 3.3.1 allows attackers to execute arbitrary PHP code by injecting malicious shortcodes via the WordPress REST API endpoint /wp-json/wp/v2/posts.

PoC Insert PHP plugin < 3.3.1 web-application wordpress php rce code-injection
1r 2t 1c updated