PT-2025-42214 · WordPress · Is-Human

Published 2025-10-15 · Updated 2025-10-15 · CVE-2011-10033

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions WordPress plugin is-human versions 1.4.2 and earlier

Description The WordPress plugin is-human versions 1.4.2 and earlier contains an eval injection issue in the /is-human/engine.php file. This can be triggered via the type parameter when the action parameter is set to log-reset. The root cause is the unsafe use of the eval() function on user-controlled input, potentially allowing execution of attacker-supplied PHP and OS commands. This could lead to arbitrary code execution as the webserver user, site compromise, or data exfiltration. The is-human plugin was made defunct in June 2008 and is no longer available for download. This issue was exploited in the wild in March 2012.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2011-10033

Affected Products

Is-Human

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-10033 · Security Note
• https://trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-alert-more-wordpress-is_human-plugin-remote-command-injection-attack-detected · Note
• https://t.me/CVEtracker/34925 · Telegram Post
• https://vulncheck.com/advisories/wordpress-plugin-is-human-eval-injection-rce · Note
• https://web.archive.org/web/20120115212202/http://blog.spiderlabs.com/2012/01/honeypot-alert-is-human-wordpress-plugin-remote-command-execution-attack-detected.html · Note
• https://wordpress.org/plugins/is-human · Note
• https://exploit-db.com/exploits/17299 · Note