Platform
wordpress
Component
add-custom-codes
Fixed in
4.80.1
CVE-2025-30975 identifies a Code Injection vulnerability within the SaifuMak Add Custom Codes WordPress plugin. This flaw allows attackers to inject arbitrary code, potentially gaining control over the affected WordPress site and its underlying server. The vulnerability impacts versions from 0.0.0 through 4.80, and a fix is available in version 5.0.
The Code Injection vulnerability in SaifuMak Add Custom Codes poses a significant risk. An attacker could leverage this flaw to execute arbitrary PHP code on the server hosting the WordPress site. This could lead to a complete compromise of the site, including data theft, modification, or deletion. Furthermore, an attacker could potentially use the compromised site as a launchpad for attacks against other systems on the same network, expanding the blast radius. The ability to inject code provides a high degree of control, making this a particularly dangerous vulnerability.
CVE-2025-30975 was published on 2025-08-20. As of this date, there are no publicly known proof-of-concept exploits. The EPSS score is pending evaluation, but the Code Injection nature of the vulnerability suggests a potentially high probability of exploitation if a suitable exploit is developed and made public. Monitor security advisories and threat intelligence feeds for updates.
Exploit Status
EPSS
0.05% (14% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-30975 is to immediately upgrade the SaifuMak Add Custom Codes plugin to version 5.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to reduce the attack surface. While a direct WAF rule targeting this specific code injection is unlikely, general PHP code injection rules can provide some protection. Regularly review the plugin's code for suspicious modifications and implement robust input validation practices within your WordPress theme and other plugins.
Update to version 5.0, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-30975 is a Code Injection vulnerability affecting SaifuMak Add Custom Codes versions 0.0.0–4.80, allowing attackers to inject malicious code. It carries a CVSS score of 7.5 (HIGH).
You are affected if your WordPress site uses SaifuMak Add Custom Codes version 0.0.0 through 4.80. Check your plugin versions immediately.
Upgrade the SaifuMak Add Custom Codes plugin to version 5.0 or later. If immediate upgrade is not possible, temporarily disable the plugin.
As of 2025-08-20, there are no publicly known active exploits, but the vulnerability's nature suggests a potential for exploitation.
Refer to the SaifuMak plugin documentation or their official website for the latest advisory regarding CVE-2025-30975.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.