PHP Code Injection Vulnerability in Add Custom Page Template Plugin for WordPress

CVE-2025-3491

What is CVE-2025-3491?

The Add Custom Page Template plugin for WordPress is subject to a PHP Code Injection vulnerability that allows authenticated attackers with Administrator privileges to execute arbitrary code on the server. This flaw arises from inadequate sanitization of the 'template_name' parameter within the 'acpt_validate_setting' function. Attackers can exploit this weakness in all versions up to 2.0.1, potentially leading to serious security breaches.

References