CVE-2025-13035 Overview
CVE-2025-13035 is a PHP Code Injection vulnerability [CWE-94] in the Code Snippets plugin for WordPress, affecting all versions up to and including 3.9.1. The flaw resides in the evaluate_shortcode_from_flat_file method, which calls PHP's extract() function on attacker-controlled shortcode attributes. Authenticated attackers with Contributor-level access can overwrite the $filepath variable passed to require_once, enabling arbitrary PHP execution through PHP filter chains. Exploitation requires an administrator to enable the "Enable file-based execution" setting and create at least one active Content snippet.
Critical Impact
Authenticated Contributor-level users can execute arbitrary PHP code on the WordPress server through the [code_snippet] shortcode, leading to full site compromise.
Affected Products
- Code Snippets plugin for WordPress, all versions through 3.9.1
- WordPress sites with the "Enable file-based execution" setting enabled
- WordPress installations with at least one active Content snippet configured
Discovery Timeline
- 2025-11-19 - CVE-2025-13035 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-13035
Vulnerability Analysis
The Code Snippets plugin processes the [code_snippet] shortcode through the evaluate_shortcode_from_flat_file method in class-front-end.php. This method invokes PHP's extract() function on user-supplied shortcode attributes, converting array keys into local variables in the current scope. Because the method later uses a $filepath variable in a require_once call, an attacker who supplies a filepath shortcode attribute can override that variable. The plugin then includes the attacker-chosen path, allowing execution of arbitrary PHP through techniques such as PHP filter chains that craft executable payloads from user-uploaded files.
Root Cause
The root cause is unsafe use of extract() against attacker-controlled input combined with a downstream file inclusion. The extract() call has no EXTR_SKIP flag or whitelist, so any shortcode attribute name overwrites the corresponding variable. The subsequent require_once($filepath) trusts the now-tainted variable without validation. The vulnerability is classified as Improper Control of Generation of Code [CWE-94].
Attack Vector
Exploitation requires Contributor-level WordPress access or higher. The attacker submits a post or content area containing a malicious [code_snippet filepath="..."] shortcode. The supplied filepath leverages PHP filter chains (for example, php://filter/convert.base64-decode/resource=...) to load attacker-controlled data and have PHP interpret it as code. The attack is only viable when an administrator has previously enabled the "Enable file-based execution" option and at least one active Content snippet exists, which raises the attack complexity but does not eliminate the risk on sites where these prerequisites are routinely met.
No verified public proof-of-concept code is available. Technical details are documented in the WordPress plugin source for class-front-end.php and the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-13035
Indicators of Compromise
- Posts, pages, or comments containing [code_snippet] shortcodes with unexpected attributes such as filepath, file, or path
- Web server access logs showing requests containing php://filter/ strings or base64-decode filter chains
- Unexplained PHP files, web shells, or modified theme/plugin files appearing in wp-content/ directories
- New or modified administrator accounts following Contributor-level user activity
Detection Strategies
- Audit the Code Snippets plugin version across all WordPress installations and flag versions ≤ 3.9.1
- Inspect post content for [code_snippet] shortcodes containing variable-overwrite attributes
- Review WordPress audit logs for Contributor-level accounts publishing or editing content immediately before administrator-side errors
- Correlate uploaded media files with subsequent require_once activity using PHP error logs and access logs
Monitoring Recommendations
- Enable PHP error logging and monitor for require_once warnings referencing unexpected paths or wrappers
- Alert on web requests where query strings or POST bodies contain php://filter patterns
- Track WordPress plugin settings changes, particularly toggling of "Enable file-based execution"
- Monitor file integrity on wp-content/plugins/ and wp-content/uploads/ for unauthorized PHP files
How to Mitigate CVE-2025-13035
Immediate Actions Required
- Update the Code Snippets plugin to a version above 3.9.1 as soon as the vendor patch is available
- Disable the "Enable file-based execution" setting unless it is operationally required
- Review Contributor and Author-level accounts and remove any that are unnecessary or inactive
- Audit existing Content snippets and remove those that are not in active use
Patch Information
The vendor fix is published in the WordPress plugin changeset 3397635. Site administrators should upgrade to the patched release referenced in the Wordfence Vulnerability Report and verify the plugin version through the WordPress admin dashboard.
Workarounds
- Leave the "Enable file-based execution" feature disabled until the plugin is patched
- Restrict user role assignments so that untrusted users do not hold Contributor-level access
- Deploy a Web Application Firewall (WAF) rule blocking shortcode payloads that contain php://filter or filepath override attributes
- Remove the Code Snippets plugin entirely if it is not actively used on the site
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
