CVE-2026-25001

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25001", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-28T09:50:57.103Z", "datePublished": "2026-03-25T16:14:36.514Z", "dateUpdated": "2026-04-28T16:14:52.806Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "post-snippets", "product": "Post Snippets", "vendor": "Saad Iqbal", "versions": [{"changes": [{"at": "4.0.13", "status": "unaffected"}], "lessThanOrEqual": "4.0.12", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Doan Dinh Van | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:18:27.556Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.<p>This issue affects Post Snippets: from n/a through <= 4.0.12.</p>"}], "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through <= 4.0.12."}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "Remote Code Inclusion"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:52.806Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/post-snippets/vulnerability/wordpress-post-snippets-plugin-4-0-12-remote-code-execution-rce-vulnerability?_s_id=cve"}], "title": "WordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T19:57:20.422265Z", "id": "CVE-2026-25001", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T20:07:57.562Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25001", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-25T19:57:20.422265Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T19:57:36.930Z"}}], "cna": {"title": "WordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Doan Dinh Van | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Saad Iqbal", "product": "Post Snippets", "versions": [{"status": "affected", "changes": [{"at": "4.0.13", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "4.0.12"}], "packageName": "post-snippets", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:18:27.556Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/post-snippets/vulnerability/wordpress-post-snippets-plugin-4-0-12-remote-code-execution-rce-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through <= 4.0.12.", "supportingMedia": [{"type": "text/html", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.<p>This issue affects Post Snippets: from n/a through <= 4.0.12.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:07.626Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25001", "state": "PUBLISHED", "dateUpdated": "2026-04-27T20:07:57.562Z", "dateReserved": "2026-01-28T09:50:57.103Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-25T16:14:36.514Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "post-snippets", "product": "Post Snippets", "vendor": "Saad Iqbal", "versions": [{"changes": [{"at": "4.0.13", "status": "unaffected"}], "lessThanOrEqual": "4.0.12", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through <= 4.0.12."}, {"lang": "es", "value": "Vulnerabilidad de control inadecuado de la generaci\u00f3n de c\u00f3digo ('Inyecci\u00f3n de C\u00f3digo') en Saad Iqbal Post Snippets post-snippets permite la Inclusi\u00f3n Remota de C\u00f3digo. Este problema afecta a Post Snippets: desde n/a hasta &lt;= 4.0.12."}], "id": "CVE-2026-25001", "lastModified": "2026-06-17T10:23:57.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25001", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T19:57:20.422265Z", "version": "2.0.3"}}]}, "published": "2026-03-25T17:16:41.320", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/post-snippets/vulnerability/wordpress-post-snippets-plugin-4-0-12-remote-code-execution-rce-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.12]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.0.13"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Post Snippets", "source": "cna", "vendor": "Saad Iqbal"}, "product": "post_snippets", "vendor": "saad_iqbal"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-25T21:54:30.815563+00:00", "value": {"mitigation_remediation": ["Upgrade Post Snippets plugin to version 4.0.13 or later if available. They did not release a version 4.0.13 daily, so keep an eye for a new update. If an upgrade cannot be applied, remove or deactivate the Post Snippets plugin entirely."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The impact reaches users of the WordPress Post Snippets plugin from its earliest release through version 4.0.12. The plugin is maintained by Saad Iqbal and widely adopted across many WordPress installations. Any website that has not upgraded beyond 4.0.12 is susceptible.", "description_and_impact": "The vulnerability is an Improper Control of Generation of Code flaw that permits Remote Code Inclusion within the WordPress Post Snippets plugin. It allows an attacker to execute arbitrary code on the web host, compromising confidentiality, integrity, and availability of the affected site. The weakness is identified as CWE\u201194, highlighting a code injection issue where user input or plugin configuration can lead to code execution.", "risk_and_exploitability": "The CVSS score of 8.5 places this vulnerability in the high severity range, indicating significant risk when a remote attacker can trigger it. EPSS data is not available, but the potential for remote exploitation is clear. The vulnerability is not yet listed in the CISA KEV catalog, yet the nature of the flaw makes it highly likely to be targeted once a patch becomes known. The most probable attack path involves a remote actor sending a specially crafted request or manipulating plugin data to trigger code execution; this inference is based on the described code injection mechanism."}}}}, "created": "2026-03-26T11:39:38.542955+00:00", "updated": "2026-03-26T12:13:04.139134+00:00", "vendors": ["saad_iqbal", "saad_iqbal$PRODUCT$post_snippets", "wordpress", "wordpress$PRODUCT$wordpress"]}