{
 "id": "WPSEC-2026-3135",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3135/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3135/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3135/index.md",
 "title": "Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.11 - Missing Authorization to Unauthenticated Snippet Execution via Code Error Notice",
 "description": "The Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts plugin for WordPress is vulnerable to unauthorized code execution via the 'wbcr_inp_save_snippet_result=code-error' parameter in all versions from 2.7.0 up to, and including, 2.7.11, due to a missing capability check and nonce validation in the get_throw_php_error_notice() function, which runs on admin_init and calls getSnippetError() for a snippet ID taken from the 'post' parameter. This makes it possible for unauthenticated attackers to make the site execute any existing PHP or Universal snippet whenever they choose, including snippets that are deactivated or limited to certain locations or conditions.",
 "plugin": {
  "slug": "insert-php",
  "name": "Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts",
  "full_name": "Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts",
  "wordpress_org": "https://wordpress.org/plugins/insert-php/",
  "advisories_url": "https://wpsec.com/vuln/plugin/insert-php/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/insert-php"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.7.0",
    "from_inclusive": true,
    "to": "2.7.12",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.7.0 before 2.7.12"
  ]
 },
 "introduced_in": "2.7.0",
 "fixed_in": "2.7.12",
 "remediation": "Update to 2.7.12 or later.",
 "fix_released": "2026-11-13T09:17:42+00:00",
 "published": "2026-11-14T09:40:51+00:00",
 "updated": "2026-11-13T15:54:24.014073+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3135/",
  "https://plugins.svn.wordpress.org/insert-php/tags/2.7.12/",
  "https://wordpress.org/plugins/insert-php/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/insert-php",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-14"
 }
}