CVE-2025-13035

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13035", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-11T17:05:21.590Z", "datePublished": "2025-11-19T07:46:08.602Z", "dateUpdated": "2026-04-08T17:21:28.619Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:28.619Z"}, "affected": [{"vendor": "codesnippetspro", "product": "Code Snippets", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the plugin's use of extract() on attacker-controlled shortcode attributes within the `evaluate_shortcode_from_flat_file` method, which can be used to overwrite the `$filepath` variable and subsequently passed to require_once. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server via the `[code_snippet]` shortcode using PHP filter chains granted they can trick an administrator into enabling the \"Enable file-based execution\" setting and creating at least one active Content snippet."}], "title": "Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c7247c-2fc3-46ff-858e-2242b7211476?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L295"}, {"url": "https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L296"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3397635%40code-snippets%2Ftrunk&old=3395415%40code-snippets%2Ftrunk&sfp_email=&sfph_mail=#file23"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-11-12T13:54:28.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-18T19:03:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T17:20:53.291261Z", "id": "CVE-2025-13035", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T17:21:07.364Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13035", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-19T17:20:53.291261Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T17:20:59.227Z"}}], "cna": {"title": "Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "codesnippetspro", "product": "Code Snippets", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.9.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-12T13:54:28.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-18T19:03:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c7247c-2fc3-46ff-858e-2242b7211476?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L295"}, {"url": "https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L296"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3397635%40code-snippets%2Ftrunk&old=3395415%40code-snippets%2Ftrunk&sfp_email=&sfph_mail=#file23"}], "descriptions": [{"lang": "en", "value": "The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the plugin's use of extract() on attacker-controlled shortcode attributes within the `evaluate_shortcode_from_flat_file` method, which can be used to overwrite the `$filepath` variable and subsequently passed to require_once. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server via the `[code_snippet]` shortcode using PHP filter chains granted they can trick an administrator into enabling the \"Enable file-based execution\" setting and creating at least one active Content snippet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:28.619Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13035", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:28.619Z", "dateReserved": "2025-11-11T17:05:21.590Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-19T07:46:08.602Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Code Snippets", "vendor": "codesnippetspro", "versions": [{"lessThanOrEqual": "3.9.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the plugin's use of extract() on attacker-controlled shortcode attributes within the `evaluate_shortcode_from_flat_file` method, which can be used to overwrite the `$filepath` variable and subsequently passed to require_once. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server via the `[code_snippet]` shortcode using PHP filter chains granted they can trick an administrator into enabling the \"Enable file-based execution\" setting and creating at least one active Content snippet."}, {"lang": "es", "value": "El plugin Code Snippets para WordPress es vulnerable a la inyecci\u00f3n de c\u00f3digo PHP en todas las versiones hasta la 3.9.1, inclusive. Esto se debe al uso de 'extract()' por parte del plugin en atributos de shortcode controlados por el atacante dentro del m\u00e9todo 'evaluate_shortcode_from_flat_file', que puede usarse para sobrescribir la variable '$filepath' y posteriormente pasarla a 'require_once'. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, ejecuten c\u00f3digo PHP arbitrario en el servidor a trav\u00e9s del shortcode '[code_snippet]' utilizando cadenas de filtro PHP, siempre que puedan enga\u00f1ar a un administrador para que habilite la configuraci\u00f3n 'Enable file-based execution' y cree al menos un fragmento de contenido activo."}], "id": "CVE-2025-13035", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13035", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-19T17:20:53.291261Z", "version": "2.0.3"}}]}, "published": "2025-11-19T08:15:51.780", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L295"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L296"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3397635%40code-snippets%2Ftrunk&old=3395415%40code-snippets%2Ftrunk&sfp_email=&sfph_mail=#file23"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c7247c-2fc3-46ff-858e-2242b7211476?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:08:31.208373+00:00", "value": {"mitigation_remediation": ["Check the WordPress plugin repository or the vendor\u2019s website for an official patch or newer release of the Code Snippets plugin.", "Disable the \"Enable file\u2011based execution\" setting if it is not required for site functionality.", "Remove or deactivate any active content snippets that are not necessary for site operation."], "summary": {"action": "Patch Immediately", "impact": "Authenticated PHP Code Injection"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress Code Snippets plugin, versions up to and including 3.9.1. Sites running these versions with the \"Enable file\u2011based execution\" setting enabled and at least one active content snippet are susceptible. No other vendors or products are listed.", "description_and_impact": "The vulnerability arises from the misuse of extract() on shortcode attributes within the evaluate_shortcode_from_flat_file method, allowing an authenticated Contributor\u2011plus user to overwrite the $filepath variable and subsequently force the plugin to require an attacker\u2011controlled file. This PHP code injection (CWE\u201194) can execute arbitrary server\u2011side code, enabling the attacker to compromise secrets, install backdoors, or pivot to further attacks.", "risk_and_exploitability": "The CVSS score of 8 highlights the high impact of code execution for authenticated users, while the EPSS score of less than 1% indicates a low overall likelihood of exploitation. The flaw is not in the CISA KEV catalog. Exploitation requires an authenticated Contributor or higher, the activation of the file\u2011based execution setting, and an active snippet, limiting the attack surface but remaining a serious risk for exposed WordPress sites."}}}}, "created": "2025-11-21T09:16:13.864855+00:00", "updated": "2026-04-21T18:15:36.370056+00:00", "vendors": ["codesnippets", "codesnippets$PRODUCT$code_snippets", "wordpress", "wordpress$PRODUCT$wordpress"]}