CVE-2017-20251: WordPress Insert PHP Plugin RCE Flaw

CVE-2017-20251 Overview

CVE-2017-20251 is a PHP code injection vulnerability affecting the WordPress Insert PHP plugin in versions prior to 3.3.1. The flaw allows unauthenticated attackers to execute arbitrary PHP code on the underlying server. Attackers exploit the issue by submitting crafted POST requests to the WordPress REST API endpoint wp-json/wp/v2/posts containing malicious insert_php shortcodes. These shortcodes instruct the plugin to include and execute remote PHP files of the attacker's choosing. The weakness is classified as Improper Control of Generation of Code [CWE-94].

Critical Impact

Unauthenticated remote attackers can achieve full remote code execution on WordPress servers running vulnerable versions of the Insert PHP plugin, leading to complete site compromise.

Affected Products

• WordPress Insert PHP plugin versions prior to 3.3.1
• WordPress installations exposing the wp-json/wp/v2/posts REST API endpoint with the plugin enabled
• Sites that allow content submission processed through the vulnerable shortcode parser

Discovery Timeline

• 2026-06-09 - CVE-2017-20251 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2017-20251

Vulnerability Analysis

The Insert PHP plugin registers an insert_php shortcode that evaluates the PHP code contained within its body. The plugin processes this shortcode whenever WordPress renders post content, including content submitted through the REST API. Because the REST API endpoint wp-json/wp/v2/posts accepts unauthenticated submissions in certain configurations, attackers can store PHP payloads that the server then executes. The vulnerability is a textbook Code Injection flaw [CWE-94], where untrusted input is treated as executable code without validation or sandboxing.

Root Cause

The plugin's shortcode handler passes user-controlled content directly to a PHP execution context. There is no allowlist of permitted functions, no input sanitization, and no authentication requirement enforced before shortcode evaluation. When combined with WordPress's permissive REST API behavior, the result is unauthenticated remote code execution.

Attack Vector

An attacker sends a POST request to /wp-json/wp/v2/posts containing post content with an insert_php shortcode. The shortcode body references a remote PHP file via an include directive. When WordPress processes the post for rendering, the plugin evaluates the shortcode and includes the attacker-hosted PHP file. The remote file executes in the context of the web server user, granting the attacker control over the WordPress installation. Public proof-of-concept material is referenced in Exploit-DB #41308 and the VulnCheck Advisory on WordPress Plugin.

Detection Methods for CVE-2017-20251

Indicators of Compromise

• POST requests to /wp-json/wp/v2/posts containing the string insert_php or [insert_php] in the request body.
• Outbound HTTP or HTTPS requests from the web server to unknown hosts immediately after a REST API write event, indicating remote file inclusion.
• New or modified PHP files in the WordPress uploads or plugin directories with recent timestamps.
• Web shells or backdoors written under wp-content/uploads/ following suspicious POST activity.

Detection Strategies

• Inspect web server access logs for unauthenticated POST requests to wp-json/wp/v2/posts followed by GET requests retrieving the created post.
• Hunt across stored post content for the insert_php shortcode in the wp_posts table.
• Alert on PHP processes spawning shell utilities such as sh, bash, curl, or wget from the web server context.

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized analytics platform for correlation of REST API writes with shortcode payloads.
• Monitor file integrity across the wp-content/plugins/ and wp-content/uploads/ directories.
• Track egress connections from PHP-FPM or Apache worker processes to identify remote file inclusion attempts.

How to Mitigate CVE-2017-20251

Immediate Actions Required

• Upgrade the Insert PHP plugin to version 3.3.1 or later, or remove the plugin if it is not required.
• Audit the wp_posts table for stored insert_php shortcodes and remove any malicious entries.
• Review the WordPress installation for unauthorized administrator accounts, modified PHP files, and unknown scheduled tasks.
• Rotate WordPress credentials, secret keys in wp-config.php, and any API tokens that may have been exposed.

Patch Information

The vendor addressed the issue in Insert PHP version 3.3.1. Plugin details are available at the WordPress Plugin Overview. Administrators should apply the update through the WordPress plugin manager or replace the plugin files manually.

Workarounds

• Disable the Insert PHP plugin until patching is complete.
• Restrict access to the /wp-json/wp/v2/posts endpoint using a web application firewall rule that blocks unauthenticated POST requests.
• Filter inbound request bodies for the insert_php shortcode and reject matching requests at the perimeter.
• Enforce disable_functions in php.ini to limit dangerous PHP functions such as exec, system, and passthru.

# Configuration example: block insert_php shortcode submissions via nginx
location ~ ^/wp-json/wp/v2/posts {
    if ($request_method = POST) {
        if ($request_body ~* "insert_php") {
            return 403;
        }
    }
}