Platform
wordpress
Component
add-custom-page-template
Fixed in
2.0.2
CVE-2025-3491 describes a Remote Code Execution (RCE) vulnerability affecting the Add custom page template plugin for WordPress. This vulnerability stems from insufficient sanitization of user-supplied input, allowing authenticated administrators to execute arbitrary code on the server. The vulnerability impacts versions 0.0.0 through 2.0.1, and a patch is available in version 2.0.2.
An attacker exploiting this vulnerability could gain complete control over the WordPress server. By injecting malicious PHP code through the 'acptvalidatesetting' function, an authenticated administrator could execute arbitrary commands, install malware, steal sensitive data, or even completely compromise the server. The potential impact extends to any data stored on the server, including user credentials, database information, and website content. This vulnerability shares similarities with other PHP code injection flaws, where improper input validation leads to code execution.
CVE-2025-3491 was publicly disclosed on 2025-04-26. No public proof-of-concept (PoC) code has been released at the time of writing, but the vulnerability's nature makes it likely that a PoC will emerge. The EPSS score is currently pending evaluation, but the RCE nature of the vulnerability suggests a potential for medium to high exploitation probability. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
1.88% (83% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-3491 is to immediately upgrade the Add custom page template plugin to version 2.0.2 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily restricting administrator access to the plugin's settings. Web application firewalls (WAFs) configured to detect and block PHP code injection attempts can provide an additional layer of protection. Monitor WordPress logs for suspicious activity, particularly related to the 'acptvalidatesetting' function. After upgrading, verify the fix by attempting to inject a simple PHP payload through the plugin's settings and confirming that it is properly sanitized.
Actualice el plugin 'Add custom page template' a la versión 2.0.2 o superior para mitigar la vulnerabilidad de inyección de código PHP. Asegúrese de realizar una copia de seguridad completa de su sitio web antes de actualizar cualquier plugin. Verifique que la actualización se haya realizado correctamente revisando los registros de errores de WordPress.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-3491 is a Remote Code Execution vulnerability in the Add custom page template WordPress plugin, allowing authenticated admins to execute code due to insufficient input sanitization.
You are affected if you are using the Add custom page template plugin in WordPress versions 0.0.0 through 2.0.1. Check your plugin version immediately.
Upgrade the Add custom page template plugin to version 2.0.2 or later to resolve the vulnerability. If immediate upgrade is not possible, restrict administrator access to the plugin's settings.
While no active exploitation has been confirmed, the RCE nature of the vulnerability makes it likely that exploitation attempts will occur. Monitor your systems closely.
Refer to the official WordPress security announcements and the Add custom page template plugin's website for updates and advisories related to CVE-2025-3491.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.