PT-2025-33467 · WordPress · Inpersttion For Theme

Peter Thaleikis · Published 2025-08-15 · Updated 2025-08-15 · CVE-2025-8905

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Inpersttion For Theme plugin for WordPress versions prior to 1.0

Description: The Inpersttion For Theme plugin for WordPress is susceptible to Remote Code Execution in versions up to and including 1.0 via the theme section shortcode() function. This is due to insufficient restrictions on callable functions, allowing authenticated attackers with Contributor-level access or higher to execute code on the server. The execution is limited to arbitrary functions without user-supplied parameters.

Recommendations: Update the Inpersttion For Theme plugin to a version newer than 1.0.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-8905

Affected Products

Inpersttion For Theme

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-8905 · Security Note
• https://twitter.com/CVEnew/status/1956289010869133777 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1956297098397179921 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/cd4dc8ab-792b-41ff-a7b9-77a11c02d91b?source=cve · Note
• https://t.me/CVEtracker/30112 · Telegram Post
• https://plugins.trac.wordpress.org/browser/err-our-team/trunk/inc/inpersttion-for-shortcode.php#L8 · Note