WordPress Insert PHP Plugin Unauthenticated Code Execution

WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2017-20251 is a critical PHP code injection vulnerability in the WordPress Insert PHP plugin that allows unauthenticated attackers to execute arbitrary PHP code on vulnerable servers. By exploiting the WordPress REST API's wp-json/wp/v2/posts endpoint, attackers can inject malicious shortcodes that trigger the execution of remote PHP files. This vulnerability is particularly severe because it requires no authentication, has a CVSS score of 9.8, and affects any WordPress installation using vulnerable versions of the plugin. Organizations relying on WordPress for content management face complete system compromise, data exfiltration, and potential lateral movement within their infrastructure.

Casky.ai's 301 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify attack indicators such as unusual POST requests to REST API endpoints with insert_php shortcode patterns, suspicious PHP file inclusion attempts, and remote code execution signatures. The platform's skill set enables detection of the reconnaissance phase where attackers probe for plugin presence, the initial access attempts via crafted REST API payloads, and the execution phase where injected shortcodes trigger malicious PHP code. Security teams would see findings highlighting CWE-94 (Improper Control of Generation of Code) patterns, anomalous REST API activity from unauthenticated sources, and indicators of PHP file inclusion or eval()-like functions being triggered through WordPress hooks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2017-20251.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2017-20251

Casky has 301 skills that investigate the attack patterns behind CVE-2017-20251. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn