CVE-2025-8905: WordPress Inpersttion For Theme RCE Flaw

CVE-2025-8905 Overview

CVE-2025-8905 is a Remote Code Execution vulnerability in the Inpersttion For Theme plugin for WordPress. The flaw affects all versions up to and including 1.0. It resides in the theme_section_shortcode() function, which fails to restrict which PHP functions can be invoked through shortcode attributes. Authenticated users with Contributor-level access or higher can trigger execution of arbitrary functions on the server. Exploitation is limited to functions that do not require user-supplied parameters, which narrows but does not eliminate the attack surface. The issue is categorized under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated contributors can execute arbitrary PHP functions on vulnerable WordPress servers, enabling reconnaissance, data exposure, and potential pivoting to full site compromise.

Affected Products

Inpersttion For Theme plugin for WordPress — all versions through 1.0
WordPress sites allowing Contributor-level or higher account registration
Hosting environments running the plugin without compensating controls

Discovery Timeline

2025-08-15 - CVE-2025-8905 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8905

Vulnerability Analysis

The Inpersttion For Theme plugin registers a shortcode handler named theme_section_shortcode() inside inc/inpersttion-for-shortcode.php. The handler accepts an attribute that is passed to a PHP callable without an allow-list check. When WordPress processes content containing the shortcode, the plugin invokes the attacker-controlled function name.

Because WordPress permits Contributor accounts to author draft content containing shortcodes, any authenticated user at that trust tier can stage malicious shortcode payloads. The resulting function call executes in the context of the PHP process serving the site. Exploitation is constrained to functions that accept no caller-supplied parameters, but many sensitive built-ins meet that criterion, including information-disclosure routines and process-listing helpers.

Root Cause

The root cause is improper control of code generation [CWE-94]. The plugin treats a user-controlled string as a trusted callable and executes it through a dynamic function invocation. There is no allow-list, no capability check beyond the default shortcode processing, and no input validation on the function name supplied through the shortcode attribute.

Attack Vector

An attacker first obtains Contributor-level access, either through open registration, credential compromise, or social engineering. The attacker then creates a post or page containing the vulnerable shortcode and supplies the target function name as an attribute. When the content is rendered, either through preview or publication, the plugin executes the specified function on the server. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for details.

Detection Methods for CVE-2025-8905

Indicators of Compromise

Posts, drafts, or revisions containing the theme_section_shortcode shortcode authored by Contributor accounts
Unexpected PHP function names appearing as shortcode attributes in wp_posts content
Web server logs showing POST requests to post.php or admin-ajax.php with shortcode payloads from low-privilege accounts
New or unfamiliar Contributor-level accounts registered shortly before suspicious content appears

Detection Strategies

Query the WordPress database for post content containing the vulnerable shortcode name and flag any instance
Monitor PHP error logs for warnings generated by invalid function names supplied through the shortcode
Correlate Contributor-level authoring activity with outbound network connections from the web host

Monitoring Recommendations

Alert on installation or activation of the Inpersttion For Theme plugin across managed WordPress fleets
Track creation of Contributor accounts and review post content authored within the first 24 hours
Capture process execution telemetry on web servers to detect PHP spawning shells or network utilities

How to Mitigate CVE-2025-8905

Immediate Actions Required

Deactivate and remove the Inpersttion For Theme plugin from all WordPress installations until a fixed version is available
Audit user accounts and revoke Contributor or higher privileges that are not strictly required
Review published and draft content for the vulnerable shortcode and purge any suspicious entries
Rotate credentials for WordPress accounts and connected services if exploitation is suspected

Patch Information

No vendor-supplied patch is referenced in the available advisories. The vulnerability affects all versions through 1.0. Monitor the Wordfence Vulnerability Report and the WordPress plugin repository for updates, and remove the plugin in the interim.

Workarounds

Restrict new user registration or disable the Contributor role until the plugin is removed or patched
Deploy a web application firewall rule that blocks requests containing the theme_section_shortcode string
Enforce least privilege on the PHP process so dangerous functions such as phpinfo or filesystem helpers are disabled via disable_functions in php.ini

bash

# Example php.ini hardening to limit function abuse
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,phpinfo,posix_getpwuid,posix_uname