Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.11 - Missing Authorization to Unauthenticated Snippet Execution via Code Error Notice
- ID
- WPSEC-2026-3135
- Plugin
- Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts (insert-php)
- Affected
- from 2.7.0 before 2.7.12
- Remediation
- Update to 2.7.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-14
- Attack surface
- Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts on WPSec AttackSurface
- Fix released
- Published
Description
The Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts plugin for WordPress is vulnerable to unauthorized code execution via the 'wbcr_inp_save_snippet_result=code-error' parameter in all versions from 2.7.0 up to, and including, 2.7.11, due to a missing capability check and nonce validation in the get_throw_php_error_notice() function, which runs on admin_init and calls getSnippetError() for a snippet ID taken from the 'post' parameter. This makes it possible for unauthenticated attackers to make the site execute any existing PHP or Universal snippet whenever they choose, including snippets that are deactivated or limited to certain locations or conditions.
References
- https://wpsec.com/vuln/WPSEC-2026-3135/
- https://plugins.svn.wordpress.org/insert-php/tags/2.7.12/
- https://wordpress.org/plugins/insert-php/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS