CVE-2025-10380: WordPress Advanced Views Plugin RCE Flaw

CVE-2025-10380 Overview

CVE-2025-10380 is a Server-Side Template Injection (SSTI) vulnerability in the Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress. The flaw affects all versions up to and including 3.7.19. It stems from insufficient input sanitization and missing access control when processing custom Twig templates in the Model panel. Authenticated users with author-level access or higher can inject Twig syntax that executes arbitrary PHP code and operating system commands on the underlying server. The issue is tracked under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine).

Critical Impact
Authenticated attackers with author-level permissions can achieve remote code execution on the WordPress host, leading to full site compromise and lateral movement.

Affected Products

Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress (versions ≤ 3.7.19)
WordPress installations where the plugin is active with author-level or higher accounts provisioned
Multisite WordPress environments that share the vulnerable plugin across subsites

Discovery Timeline

2025-09-23 - CVE-2025-10380 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10380

Vulnerability Analysis

The Advanced Views plugin renders content through the Twig template engine. The Model panel accepts user-supplied Twig markup and passes it to the rendering pipeline in src/Template_Engines/Twig.php without sufficient sanitization or capability checks. Twig, when not sandboxed, exposes PHP functions and object methods that attackers can abuse to invoke arbitrary code. Because the plugin does not restrict who may submit or modify templates, any authenticated user at the author role or above can introduce malicious Twig payloads.

Once the crafted template is processed, the Twig engine evaluates expressions that resolve to PHP callables such as system, exec, or passthru. This grants the attacker the privileges of the web server process, typically www-data or a comparable service account. From that foothold, attackers can read WordPress secrets in wp-config.php, pivot to the database, and deploy persistent backdoors.

Root Cause

The root cause is twofold. First, the Twig environment is not configured with the SandboxExtension, so dangerous filters and functions remain available during template compilation. Second, the Model panel handler relies on role checks that include author-level users rather than restricting template authoring to administrators with the unfiltered_html or equivalent privileged capability.

Attack Vector

Exploitation requires network access to the WordPress admin interface and an authenticated session at the author role or higher. The attacker submits a Twig payload through the Model panel, saves the view, and triggers rendering. The vulnerability is described in detail in the Wordfence Vulnerability Report and the affected code path is visible in the WordPress Plugin Code Reference.

// No verified public proof-of-concept code is available.
// Refer to the Wordfence advisory and the plugin source for technical detail.

Detection Methods for CVE-2025-10380

Indicators of Compromise

Unexpected modifications to Advanced Views Model entries, particularly Twig template fields containing {{ expressions referencing PHP functions such as system, exec, shell_exec, or passthru
New or modified PHP files in wp-content/uploads/ or plugin directories created by the web server user shortly after view rendering
Outbound network connections from the web server to unfamiliar hosts following plugin activity in access logs

Detection Strategies

Audit the wp_posts table for Advanced Views entries containing Twig syntax that invokes object methods, filters like |filter, or attribute lookups that resolve to executable callables
Monitor PHP process telemetry for child processes such as /bin/sh, bash, or curl spawned by the web server during requests to plugin endpoints
Correlate author-level user logins with subsequent edits to Advanced Views Models and on-disk changes in WordPress directories

Monitoring Recommendations

Enable PHP disable_functions audit logging and alert when restricted functions are invoked from template rendering paths
Forward WordPress audit logs and web server logs to a centralized SIEM and create rules around Advanced Views administrative endpoints
Track creation of new author or editor accounts and flag accounts that immediately access plugin configuration screens

How to Mitigate CVE-2025-10380

Immediate Actions Required

Update the Advanced Views plugin to a version later than 3.7.19 as soon as the vendor publishes a fixed release
Restrict the author role and above to trusted personnel and review existing accounts for unexpected privilege grants
Inspect all existing Model entries for Twig payloads that reference PHP functions or filesystem paths and remove suspicious content

Patch Information

The vendor committed a fix referenced in the WordPress Plugin Changeset. Administrators should apply the patched release through the WordPress plugin updater and verify the installed version after upgrade.

Workarounds

Deactivate the Advanced Views plugin until a patched version is installed if templates can be temporarily removed from the site
Demote non-essential author and editor accounts to contributor or subscriber roles to remove access to the Model panel
Deploy a web application firewall rule that blocks requests containing Twig metacharacters targeting plugin endpoints under /wp-admin/

bash

# Verify installed plugin version and force update via WP-CLI
wp plugin get acf-views --field=version
wp plugin update acf-views
wp plugin list --status=active | grep acf-views