CVE-2025-3491 Overview
CVE-2025-3491 is a PHP Code Injection vulnerability in the Add custom page template plugin for WordPress, affecting all versions up to and including 2.0.1. The flaw resides in the acpt_validate_setting function, which fails to properly sanitize the template_name parameter. Authenticated attackers holding Administrator-level access or above can inject PHP code that the server then executes, leading to Remote Code Execution (RCE). The weakness is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Successful exploitation grants attackers arbitrary PHP execution on the underlying web server, enabling full site takeover, lateral movement, and persistence within the WordPress environment.
Affected Products
- Add custom page template plugin for WordPress, versions ≤ 2.0.1
- WordPress installations where the plugin is active
- Any site granting plugin settings access to Administrator-level accounts
Discovery Timeline
- 2025-04-26 - CVE-2025-3491 published to the National Vulnerability Database (NVD)
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-3491
Vulnerability Analysis
The Add custom page template plugin exposes a settings handler that processes user-supplied template metadata. Within the acpt_validate_setting function, the template_name parameter flows into a code construction path without adequate sanitization or escaping. An attacker who controls this input can introduce PHP syntax that is later evaluated by the interpreter.
Because the plugin stores or processes the value in a context where it is treated as executable PHP rather than inert data, the boundary between user input and source code dissolves. This is the defining characteristic of a CWE-94 Code Injection flaw. Exploitation requires Administrator privileges, which limits the pre-conditions but does not eliminate the threat. Attackers who compromise an admin account through phishing, credential stuffing, or session theft can pivot directly to server-level code execution.
Root Cause
The root cause is insufficient input validation on the template_name parameter inside the acpt_validate_setting function. The plugin trusts authenticated administrative input and does not strip or escape PHP delimiters and control characters before the value is incorporated into code-generating logic. See the WordPress Plugin Source Code and the Wordfence Vulnerability Analysis for technical context.
Attack Vector
The attack vector is network-based and requires an authenticated session at the Administrator role or higher. An attacker submits a crafted template_name value through the plugin's settings interface. The injected PHP payload is then processed by the vulnerable function and executed within the WordPress runtime context, giving the attacker the same privileges as the web server user. No verified public exploit code is available at the time of writing.
Detection Methods for CVE-2025-3491
Indicators of Compromise
- Unexpected modifications to plugin files under wp-content/plugins/add-custom-page-template/
- New or altered PHP files in the WordPress webroot that were not introduced by a legitimate update
- Outbound network connections from the PHP worker process to unfamiliar hosts following administrative activity
- Web server logs showing POST requests to plugin settings endpoints containing PHP tokens such as <?php, system(, or eval(
Detection Strategies
- Inspect WordPress audit logs for changes to plugin settings made by administrator accounts, correlating timestamps with anomalous file system writes
- Apply web application firewall (WAF) rules that flag PHP syntax in plugin parameters, particularly the template_name field
- Scan the plugin directory and uploads folder for webshells using YARA signatures targeting common PHP backdoor patterns
Monitoring Recommendations
- Forward WordPress access and error logs to a centralized SIEM and alert on plugin settings updates outside of change windows
- Monitor the wp_options table and plugin configuration for unexpected serialized payloads containing PHP code
- Track administrator authentication events and flag logins from new geolocations or user agents that immediately interact with plugin settings
How to Mitigate CVE-2025-3491
Immediate Actions Required
- Deactivate the Add custom page template plugin on any WordPress site running version 2.0.1 or earlier until a patched release is verified
- Audit Administrator accounts, enforce strong unique passwords, and require multi-factor authentication for all privileged WordPress users
- Review plugin settings and the WordPress filesystem for signs of prior injection or backdoor placement
Patch Information
No fixed version is listed in the available CVE data. Site operators should consult the Wordfence Vulnerability Analysis and the plugin's official WordPress.org page for updated release information, and apply any vendor-provided update once published.
Workarounds
- Remove the plugin entirely if it is not essential to site functionality
- Restrict Administrator access using IP allowlists on wp-admin to limit who can reach the vulnerable settings endpoint
- Deploy a WAF ruleset that blocks request bodies containing PHP open tags or executable function names in plugin parameters
- Apply least-privilege principles so that day-to-day content management is performed under Editor or lower roles rather than Administrator
# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate add-custom-page-template
wp plugin delete add-custom-page-template
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
