CVE-2025-30975: Add Custom Codes Plugin RCE Vulnerability

CVE-2025-30975 Overview

CVE-2025-30975 is a code injection vulnerability in the SaifuMak Add Custom Codes WordPress plugin. The flaw affects all versions up to and including 4.80. An authenticated attacker with low privileges can leverage improper control of code generation [CWE-94] to execute arbitrary code on the target WordPress site.

The vulnerability is tracked under CWE-94 (Improper Control of Generation of Code) and is exploitable over the network. Successful exploitation grants attackers full impact on confidentiality, integrity, and availability of the affected WordPress instance.

Critical Impact

Authenticated attackers can inject and execute arbitrary code within the WordPress runtime, leading to full site compromise.

Affected Products

• SaifuMak Add Custom Codes plugin for WordPress
• All versions up to and including 4.80
• WordPress sites running the add-custom-codes plugin

Discovery Timeline

• 2025-08-20 - CVE-2025-30975 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30975

Vulnerability Analysis

The Add Custom Codes plugin allows administrators to inject custom snippets into a WordPress site. The plugin fails to properly restrict or sanitize code that is generated and executed at runtime. This weakness aligns with CWE-94, where untrusted input influences the structure of code subsequently interpreted by the server.

Exploitation requires low-privilege authenticated access but does not require user interaction. The attack complexity is rated high, suggesting that specific preconditions or configurations must be met to reliably trigger execution. Once exploited, the attacker gains the privileges of the PHP process, typically equivalent to the web server user.

Because the plugin executes generated code in the WordPress application context, an attacker can pivot to database access, file system manipulation, persistence through additional malicious snippets, and lateral movement within shared hosting environments.

Root Cause

The root cause is improper validation of input that feeds into code generation routines within the add-custom-codes plugin. Functions responsible for storing and evaluating custom snippets do not enforce strict allowlists or context-aware sanitization. As a result, attacker-controlled strings reach a PHP execution sink such as eval() or an equivalent dynamic evaluation construct.

Attack Vector

The attack vector is network-based. An authenticated user submits crafted input through the plugin's interface or associated endpoints. The plugin then stores or processes this payload and triggers PHP execution, running attacker code under the WordPress process. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-30975

Indicators of Compromise

• Unexpected modifications to plugin configuration entries in the wp_options table referencing the add-custom-codes plugin
• New or modified PHP files within wp-content/plugins/add-custom-codes/ not matching the official distribution hashes
• Outbound network connections from the web server process to unfamiliar hosts following plugin configuration changes
• WordPress audit log entries showing low-privilege accounts editing or saving custom code snippets

Detection Strategies

• Monitor PHP error logs for evidence of dynamic evaluation failures, syntax errors, or eval() warnings tied to plugin code paths
• Compare installed plugin file hashes against the vendor-provided release to detect tampering
• Inspect WordPress database tables used by the plugin for snippet entries containing functions such as system, exec, passthru, file_put_contents, or base64_decode
• Alert on web server processes spawning shell interpreters such as sh, bash, or cmd.exe

Monitoring Recommendations

• Enable verbose WordPress audit logging for plugin administration actions performed by non-administrator roles
• Track outbound DNS and HTTP requests from the web server to identify command-and-control beaconing
• Forward web server, PHP-FPM, and WordPress logs to a centralized SIEM for correlation
• Review user role assignments regularly to limit the population of accounts able to interact with the plugin

How to Mitigate CVE-2025-30975

Immediate Actions Required

• Identify all WordPress sites running the add-custom-codes plugin at version 4.80 or earlier
• Deactivate and remove the plugin if a patched release is not yet available for the environment
• Rotate WordPress administrator and contributor credentials, especially for accounts that may have been used to exploit the flaw
• Audit existing custom code snippets and remove any unrecognized or suspicious entries

Patch Information

At the time of publication, no fixed version is documented for Add Custom Codes beyond 4.80. Refer to the Patchstack vulnerability database entry for the latest remediation status from the vendor.

Workarounds

• Remove the add-custom-codes plugin from production WordPress installations until a verified patch is released
• Restrict access to the WordPress administrative interface using IP allowlisting at the web server or WAF layer
• Apply virtual patching rules in a web application firewall to block requests carrying PHP code constructs to plugin endpoints
• Reduce the number of low-privilege accounts that have any plugin management capabilities

# Disable the vulnerable plugin via WP-CLI until a fix is available
wp plugin deactivate add-custom-codes
wp plugin delete add-custom-codes

# Verify no residual files remain
find wp-content/plugins -type d -name 'add-custom-codes'