WordPress Insert PHP Plugin CVE-2017-20251: Overview of a Critical Unauthenticated RCE via REST API Shortcode Injection

Introduction

One unauthenticated HTTP POST request is enough to achieve full remote code execution on a WordPress site running the Insert PHP plugin alongside WordPress 4.7.0 or 4.7.1. CVE-2017-20251 chains a WordPress core REST API privilege escalation with the plugin's shortcode execution to create a critical attack path. A public exploit has existed since February 2017, nearly a decade before the formal CVE was assigned.

The WordPress Insert PHP plugin (now succeeded by Woody Code Snippets, maintained by Themeisle) lets site administrators embed and execute PHP code directly within WordPress posts and pages using shortcodes. The plugin was first published in November 2012 and has run on hundreds of thousands of WordPress installations. Its functionality sits where user content meets server-side code execution, which makes it a high-value target when access controls fail.

Technical Information

Vulnerability Classification

CVE-2017-20251 is classified under CWE-94 (Improper Control of Generation of Code). The NVD published the record on June 9, 2026, with VulnCheck as the source CNA. The CVSS v3 score is 9.8 and the CVSS v4.0 Base Score is 9.3 (Critical) with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Every metric sits at its most severe position: network exploitable, low complexity, no privileges required, no user interaction, and high impact across confidentiality, integrity, and availability.

Root Cause: A Two-Stage Attack Chain

This is not a single flaw but two distinct weaknesses that, combined, produce unauthenticated remote code execution.

Stage 1: REST API Privilege Escalation (WordPress Core)

WordPress versions 4.7.0 and 4.7.1 contained a privilege escalation vulnerability in the REST API that let unauthenticated users modify post content. The wp-json/wp/v2/posts endpoint, which normally requires editor or administrator privileges to modify content, failed to enforce access controls. Any external actor could send a POST request to update the content of any existing post without authentication cookies, nonces, or API keys.

Stage 2: Malicious Shortcode Execution (Insert PHP Plugin)

The Insert PHP plugin registers two shortcodes: [insert_php] and [php]. Both embed and execute arbitrary PHP code within post content. When WordPress renders a post containing these shortcodes, the plugin evaluates the embedded PHP server-side. That is the plugin's intended behavior for administrators, but it turns catastrophic when an unauthenticated attacker can write arbitrary content into posts.

Attack Flow

The exploitation sequence works as follows:

1. The attacker identifies a WordPress site running a vulnerable version of both WordPress core (4.7.0 or 4.7.1) and the Insert PHP plugin (versions before 3.3.1).
2. The attacker sends a POST request to /wp-json/wp/v2/posts/{id} with a JSON body containing malicious shortcode content. The request includes no authentication headers.
3. Because of the REST API privilege escalation flaw, WordPress accepts the unauthenticated request and saves the attacker's content to the database, overwriting the existing post.
4. The injected content contains [insert_php] or [php] shortcodes wrapping malicious PHP code, such as an include() call pointing to a remote attacker-controlled PHP file.
5. When the modified post is rendered, either by a legitimate visitor or by the attacker requesting the post URL directly, WordPress processes the shortcodes through do_shortcode().
6. The Insert PHP plugin executes the embedded PHP code on the server, giving the attacker arbitrary code execution.

Neither component alone produces the full severity. The REST API flaw allows content modification but not code execution. The Insert PHP shortcode allows code execution but normally only for authenticated administrators. Combining them removes every barrier to remote code execution.

Shortcode Injection as a Systemic WordPress Risk

Research from the Pritect Network identifies shortcode injection as a broader attack vector across the WordPress ecosystem. The problem arises when developers pass unsanitized user input into the do_shortcode() function. Stock WordPress without third-party plugins is generally safe, but plugins that register powerful shortcodes create significant risk surfaces.

The following table summarizes the attack methods and their authentication requirements:

The REST API path used in CVE-2017-20251 is the most dangerous variant because it needs no authenticated session at all. A user with the Contributor role can create posts and use the Preview function, which executes any shortcodes embedded in the post content, but the REST API path removes even that minimal barrier.

The "Unsupported When Assigned" Designation

The NVD assigned an "Unsupported When Assigned" status to this CVE, meaning the original Insert PHP software branch is no longer maintained by its developer. The NVD guidance states that "users are strongly advised to transition away from any unsupported branches." Organizations running the original Insert PHP plugin are on a code base that will never receive another security patch, whatever future vulnerabilities turn up.

Affected Systems and Versions

The following configurations are vulnerable:

• WordPress Insert PHP plugin: All versions prior to 3.3.1
• WordPress core: Versions 4.7.0 and 4.7.1 (required for the unauthenticated REST API exploitation path)
• The combination of both components is required for the full unauthenticated RCE chain

Sites running the Insert PHP plugin version 3.3.1 or later are not vulnerable to this specific shortcode injection via the REST API. Sites running WordPress 4.7.2 or later have the REST API privilege escalation patched, which breaks Stage 1 even if the plugin remains unpatched. The plugin's shortcode functionality still presents risk to authenticated users with content editing privileges on unpatched plugin versions.

The Insert PHP plugin has been superseded by Woody Code Snippets (available at the same WordPress plugin repository slug), which is actively maintained by Themeisle.

Vendor Security History

Themeisle, the current maintainer of the plugin (now branded as Woody Code Snippets), is a Romanian WordPress company founded in 2013 by Ionut Neagu, based in Bucharest. The company reports being trusted by 471,039 users and maintains a portfolio of themes (Neve, Hestia, Neve FSE) and plugins (Feedzy RSS Feeds, Masteriyo LMS, Otter Blocks).

The Insert PHP / Woody Code Snippets plugin family has accumulated several documented security vulnerabilities:

A Reddit discussion titled "Themeisle's Great History on Plugin Security Notifications" shows community awareness of the company's approach to security communications. The recurrence of code injection vulnerabilities across versions points to a systemic design challenge in plugins whose core function is evaluating user-supplied PHP code.

Mitigation Strategies

Immediate Actions

The VulnCheck advisory states that the fix is to upgrade the plugin to version 3.3.1 or later. Given the NVD "Unsupported When Assigned" designation, though, upgrading to 3.3.1 places organizations on an unmaintained code base. The recommended long-term remediation is to migrate to Woody Code Snippets, the actively maintained successor plugin available on the WordPress plugin repository.

WordPress core must also be updated to version 4.7.2 or later to address the REST API privilege escalation that enables the unauthenticated exploitation path. Applying either fix alone only breaks one stage of the two-stage attack chain. Both are necessary for complete remediation.

Hardening Measures

A Note on the CVE Timeline Gap

The nearly decade-long gap between the public exploit (February 2017) and the formal CVE assignment (June 2026) matters for vulnerability management teams. Through that entire period, security teams relying on CVE-based tracking had no formal identifier for a vulnerability with publicly available exploit code. This is why teams should monitor exploit databases and security advisories beyond the formal CVE channels.

Threat Intelligence

A fully functional proof-of-concept exploit has been publicly available on Exploit DB (EDB 41308) since February 9, 2017, credited to researcher CrashBandicot with attribution to the Sucuri security team (@sucurisecurity). The exploit needs only a single HTTP POST request with no authentication, which makes it trivially weaponizable by both sophisticated threat actors and automated scanning tools.

As of the NVD publication date, CVE-2017-20251 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Absence from KEV is not evidence of no exploitation. Several factors point to significant exploitation risk:

1. Public exploit code available since February 2017: The proof of concept has been accessible for years before the formal CVE assignment, giving attackers ample time to fold it into their toolkits.
2. Zero authentication requirement: This makes the vulnerability highly attractive for automated mass scanning campaigns targeting WordPress sites at scale.
3. WordPress ecosystem targeting: WordPress plugins are consistently among the most targeted attack surfaces, and threat actors routinely scan for vulnerable plugin installations using version enumeration tools.
4. Related REST API exploitation history: The WordPress 4.7.0/4.7.1 REST API vulnerability was widely exploited in early 2017 for content defacement campaigns. The Insert PHP plugin exploit is a more severe escalation path from the same API flaw.

Threat actor attribution for CVE-2017-20251 is not publicly documented. No sources identified particular APT groups, ransomware operators, or botnet campaigns specifically using this vulnerability.

References

• NVD: CVE-2017-20251
• VulnCheck Advisory: WordPress Insert PHP Plugin PHP Code Injection via REST API
• Exploit DB: WordPress Plugin Insert PHP 3.3.1 PHP Code Injection (EDB 41308)
• WordPress Plugin Repository: Woody Code Snippets (Insert PHP successor)
• WordPress Plugin Repository (FR): Insert PHP / Woody Code Snippets
• Pritect Network: WordPress Shortcode Injection as an Attack Vector
• SecPod: WordPress REST API Endpoint Zero Day Content Injection
• Wordfence: Insert PHP Code Snippet <= 1.3.4 Authenticated Stored XSS
• Themeisle WordPress Profile
• CISA Known Exploited Vulnerabilities Catalog