CVE-2025-3491

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3491", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-10T00:05:32.738Z", "datePublished": "2025-04-26T05:34:23.629Z", "dateUpdated": "2026-04-08T17:11:24.134Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:24.134Z"}, "affected": [{"vendor": "kiranpatil353", "product": "Add custom page template", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acpt_validate_setting' function. This is due to insufficient sanitization of the 'template_name' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server."}], "title": "Add custom page template <= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Execution", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2d97c4-b166-4d1f-8042-d0362e650c62?source=cve"}, {"url": "https://plugins.svn.wordpress.org/add-custom-page-template/trunk/index.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "ch4r0n"}], "timeline": [{"time": "2025-04-25T16:49:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-28T13:38:55.279797Z", "id": "CVE-2025-3491", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-28T15:34:54.012Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3491", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-28T13:38:55.279797Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-28T13:39:53.214Z"}}], "cna": {"title": "Add custom page template <= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Execution", "credits": [{"lang": "en", "type": "finder", "value": "ch4r0n"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "kiranpatil353", "product": "Add custom page template", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-25T16:49:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2d97c4-b166-4d1f-8042-d0362e650c62?source=cve"}, {"url": "https://plugins.svn.wordpress.org/add-custom-page-template/trunk/index.php"}], "descriptions": [{"lang": "en", "value": "The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acpt_validate_setting' function. This is due to insufficient sanitization of the 'template_name' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:24.134Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3491", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:24.134Z", "dateReserved": "2025-04-10T00:05:32.738Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-26T05:34:23.629Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Add custom page template", "vendor": "kiranpatil353", "versions": [{"lessThanOrEqual": "2.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acpt_validate_setting' function. This is due to insufficient sanitization of the 'template_name' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server."}, {"lang": "es", "value": "El complemento Add custom page template para WordPress es vulnerable a la inyecci\u00f3n de c\u00f3digo PHP, lo que provoca la ejecuci\u00f3n remota de c\u00f3digo en todas las versiones hasta la 2.0.1 incluida, mediante la funci\u00f3n \"acpt_validate_setting\". Esto se debe a una limpieza insuficiente del par\u00e1metro \"template_name\". Esto permite que atacantes autenticados, con acceso de administrador o superior, ejecuten c\u00f3digo en el servidor."}], "id": "CVE-2025-3491", "lastModified": "2026-06-17T09:20:03.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3491", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-28T13:38:55.279797Z", "version": "2.0.3"}}]}, "published": "2025-04-26T06:15:16.213", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/add-custom-page-template/trunk/index.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2d97c4-b166-4d1f-8042-d0362e650c62?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:05:38.780849+00:00", "value": {"mitigation_remediation": ["Update the plugin to the latest version or remove it if no patch is available.", "Disable or replace the vulnerable custom page template feature with a more secure alternative.", "Restrict administrator privileges and enforce strong authentication, such as two\u2011factor authentication, to limit potential attackers."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Add custom page template plugin (developed by kiranpatil353) in any version up through 2.0.1 are affected. Administrators with high\u2011level access to the site via the WordPress dashboard can trigger the injection.", "description_and_impact": "The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection that can be exploited by administrators or higher\u2011privileged users to execute arbitrary PHP code on the web server. This injection flaw, identified as CWE\u201194, allows the attacker to compromise confidentiality, integrity, and availability of the affected system by running malicious scripts or system commands. The vulnerability exists in the acpt_validate_setting function where the template_name parameter is not properly sanitized.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity risk, and the EPSS score of 2% shows a relatively low but non\u2011negligible likelihood that the vulnerability will be exploited in the wild. It is not listed in CISA KEV. Attackers must have Administrator\u2011level credentials to exploit the flaw, so the attack vector is likely internal or compromised credentials rather than external unauthenticated access. Once an attacker gains code execution, they can compromise the entire WordPress installation and potentially the underlying server."}}}}, "created": "2026-04-21T21:15:45.447572+00:00", "updated": "2026-04-21T21:15:45.447583+00:00", "vendors": []}