Add custom page template <= 2.0.1 - Injection de code PHP authentifiée (Administrateur+) menant à l'exécution de code à distance

An attacker exploiting this vulnerability could gain complete control over the WordPress server. By injecting malicious PHP code through the 'acptvalidatesetting' function, an authenticated administrator could execute arbitrary commands, install malware, steal sensitive data, or even completely compromise the server. The potential impact extends to any data stored on the server, including user credentials, database information, and website content. This vulnerability shares similarities with other PHP code injection flaws, where improper input validation leads to code execution.

WordPress websites utilizing the Add custom page template plugin, particularly those with administrator accounts that have not been secured with strong passwords and multi-factor authentication, are at significant risk. Shared hosting environments where multiple websites share the same server are also at increased risk, as a compromise of one website could potentially lead to the compromise of others.

• wordpress: Use wp-cli to check plugin version: wp plugin list --all | grep 'Add custom page template'. If the version is less than 2.0.2, the system is vulnerable. • wordpress: Examine the plugin's code for the acptvalidatesetting function and look for instances where user input is not properly sanitized. • generic web: Monitor access logs for requests containing suspicious PHP code in the 'template_name' parameter. • generic web: Check WordPress error logs for PHP errors related to the plugin.

1. 2025-04-26Disclosure

   disclosure

1. Réservé2025-04-10
2. Publiée2025-04-26
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-3491 is to immediately upgrade the Add custom page template plugin to version 2.0.2 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily restricting administrator access to the plugin's settings. Web application firewalls (WAFs) configured to detect and block PHP code injection attempts can provide an additional layer of protection. Monitor WordPress logs for suspicious activity, particularly related to the 'acptvalidatesetting' function. After upgrading, verify the fix by attempting to inject a simple PHP payload through the plugin's settings and confirming that it is properly sanitized.