PT-2025-47445 · WordPress · Code Snippets
Michael Mazzolini
·
Published
2025-11-19
·
Updated
2025-11-24
·
CVE-2025-13035
CVSS v3.1
8.0
High
| Vector | AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Code Snippets versions prior to 3.9.1
Description
The Code Snippets plugin for WordPress is susceptible to PHP Code Injection in versions up to and including 3.9.1. This occurs because the plugin utilizes
extract() on shortcode attributes controlled by attackers within the evaluate shortcode from flat file method. This can overwrite the filepath variable, which is then used with require once. Authenticated attackers with Contributor-level access or higher can execute arbitrary PHP code on the server through the [code snippet] shortcode. This requires an administrator to enable the "Enable file-based execution" setting and create at least one active Content snippet. The extract() function is used to import variables from an array into the current scope.Recommendations
Update Code Snippets to version 3.9.1 or later.
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Code Snippets