PT-2025-47445 · WordPress · Code Snippets
Michael Mazzolini
·
Publicado
2025-11-19
·
Atualizado
2025-11-24
·
CVE-2025-13035
CVSS v3.1
8.0
Alta
| Vetor | AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Code Snippets versions prior to 3.9.1
Description
The Code Snippets plugin for WordPress is susceptible to PHP Code Injection in versions up to and including 3.9.1. This occurs because the plugin utilizes
extract() on shortcode attributes controlled by attackers within the evaluate shortcode from flat file method. This can overwrite the filepath variable, which is then used with require once. Authenticated attackers with Contributor-level access or higher can execute arbitrary PHP code on the server through the [code snippet] shortcode. This requires an administrator to enable the "Enable file-based execution" setting and create at least one active Content snippet. The extract() function is used to import variables from an array into the current scope.Recommendations
Update Code Snippets to version 3.9.1 or later.
Correção
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Code Snippets