CVE-2025-10380

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10380", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-12T20:13:06.034Z", "datePublished": "2025-09-23T03:34:34.263Z", "dateUpdated": "2026-04-08T16:52:53.023Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:53.023Z"}, "affected": [{"vendor": "wplakeorg", "product": "Advanced Views \u2013 Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver\u2026", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.7.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Advanced Views \u2013 Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Model panel. This makes it possible for authenticated attackers, with author-level access or higher, to execute arbitrary PHP code and commands on the server."}], "title": "Advanced Views \u2013 Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52b04517-f0be-4bbf-818c-70a12d76bfec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.7.19/src/Template_Engines/Twig.php#L106"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3364566%40acf-views&new=3364566%40acf-views&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine", "cweId": "CWE-1336", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Aur\u00e9lien BOURDOIS"}], "timeline": [{"time": "2025-09-13T14:33:37.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-22T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-23T14:04:15.263176Z", "id": "CVE-2025-10380", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T14:04:23.987Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10380", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-23T14:04:15.263176Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T14:04:20.518Z"}}], "cna": {"title": "Advanced Views \u2013 Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI", "credits": [{"lang": "en", "type": "finder", "value": "Aur\u00e9lien BOURDOIS"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "wplakeorg", "product": "Advanced Views \u2013 Display Posts, Custom Fields, and More", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.7.19"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-13T14:33:37.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-22T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52b04517-f0be-4bbf-818c-70a12d76bfec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.7.19/src/Template_Engines/Twig.php#L106"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3364566%40acf-views&new=3364566%40acf-views&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Advanced Views \u2013 Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Model panel. This makes it possible for authenticated attackers, with author-level access or higher, to execute arbitrary PHP code and commands on the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-23T03:34:34.263Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10380", "state": "PUBLISHED", "dateUpdated": "2025-09-23T14:04:23.987Z", "dateReserved": "2025-09-12T20:13:06.034Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-23T03:34:34.263Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Advanced Views \u2013 Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver\u2026", "vendor": "wplakeorg", "versions": [{"lessThanOrEqual": "3.7.19", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Advanced Views \u2013 Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Model panel. This makes it possible for authenticated attackers, with author-level access or higher, to execute arbitrary PHP code and commands on the server."}, {"lang": "es", "value": "El plugin Advanced Views - Display Posts, Custom Fields, and More para WordPress es vulnerable a la Inyecci\u00f3n de Plantillas del Lado del Servidor en todas las versiones hasta la 3.7.19, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada insuficiente y a la falta de control de acceso al procesar plantillas Twig personalizadas en el panel Modelo. Esto permite a atacantes autenticados, con acceso de nivel de autor o superior, ejecutar c\u00f3digo PHP y comandos arbitrarios en el servidor."}], "id": "CVE-2025-10380", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10380", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-23T14:04:15.263176Z", "version": "2.0.3"}}]}, "published": "2025-09-23T04:15:46.003", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/acf-views/tags/3.7.19/src/Template_Engines/Twig.php#L106"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3364566%40acf-views&new=3364566%40acf-views&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52b04517-f0be-4bbf-818c-70a12d76bfec?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:20:14.677690+00:00", "value": {"mitigation_remediation": ["Upgrade the Advanced Views plugin to a version newer than 3.7.19, such as the latest release at the time of patching.", "Revoke author\u2011level or higher capabilities from users who do not require them, ensuring only trusted roles have access.", "If a newer version is not immediately available, disable custom Twig template support in the plugin settings or remove the Model panel feature to eliminate the template injection entry point."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Advanced Views \u2013 Display Posts, Custom Fields, and More plugin (by wplakeorg) at version 3.7.19 or older are affected. The vulnerability exists in all releases up to and including 3.7.19, regardless of other plugins or themes installed.", "description_and_impact": "Advanced Views \u2013 Display Posts, Custom Fields, and More plugin for WordPress allows authenticated users with author level or higher to inject Server\u2011Side Template Injection via unsanitized Twig templates in the Model panel. This flaw permits arbitrary execution of PHP code and system commands, enabling attackers to compromise confidentiality, integrity, and availability of the hosting environment.", "risk_and_exploitability": "The CVSS score of 8.8 indicates severe impact, but the EPSS score of less than 1% suggests very low likelihood of exploitation in the very near term. The vulnerability is not listed in the CISA KEV catalog. An attacker would need authenticated author or higher privileges, making the attack vector an authenticated, application\u2011level exploitation that could lead to remote code execution on the server."}}}}, "created": "2025-09-23T16:03:24.041636+00:00", "updated": "2026-04-22T13:30:17.920760+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}