PHP Code Injection Vulnerability in Add Custom Page Template Plugin for WordPress
CVE-2025-3491
7.2HIGH
What is CVE-2025-3491?
The Add Custom Page Template plugin for WordPress is subject to a PHP Code Injection vulnerability that allows authenticated attackers with Administrator privileges to execute arbitrary code on the server. This flaw arises from inadequate sanitization of the 'template_name' parameter within the 'acpt_validate_setting' function. Attackers can exploit this weakness in all versions up to 2.0.1, potentially leading to serious security breaches.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Add custom page template * <= 2.0.1
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
ch4r0n