CVE-2026-25366: Themeisle Woody ad snippets (insert-php) for WordPress: Code Injection Leading to RCE
CVE-2026-25366 is a code injection flaw (CWE-94) in the Themeisle Woody ad snippets WordPress plugin (slug insert-php) affecting versions up to and including 2.7.1. Patchstack rates it CVSS 3.1 9.9 (critical), requiring only low privileges over the network. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-25366 is an improper control of code generation weakness (CWE-94, code injection) in Themeisle Woody ad snippets, a WordPress plugin distributed under the slug insert-php. The CNA, Patchstack, classifies the issue as remote code execution. It was published on 2026-03-25 and its NVD status is listed as Deferred.
Impact
Patchstack assigns a CVSS 3.1 base score of 9.9 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This means the flaw is reachable over the network with low attack complexity, requires an authenticated account with low privileges, needs no user interaction, and has a changed scope with high impact on confidentiality, integrity and availability. In practice, successful exploitation could let a low-privileged WordPress user run arbitrary code on the server, potentially leading to full site compromise. The CISA ADP SSVC assessment rates technical impact as total.
Affected products and versions
- Themeisle Woody ad snippets (insert-php): all versions up to and including 2.7.1
The record does not identify a fixed version.
Exploitation status
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the SSVC assessment records exploitation as none and automatable as no. No confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.
Remediation and mitigation
- Check the Patchstack advisory and the plugin's official distribution channel for an update newer than 2.7.1 and apply it once available.
- If no fixed release can be confirmed, consider deactivating and removing the plugin, especially on sites that allow user registration.
- Review and minimize user accounts, disable open registration where not needed, and enforce strong authentication.
- Use a web application firewall or virtual patching service that covers this plugin, if available.
Detection guidance
- Inventory WordPress sites for the insert-php plugin and record installed versions.
- Review snippets stored by the plugin for unexpected or unauthorized code.
- Monitor for new or modified PHP files, unexpected administrator accounts and unusual outbound connections from web servers.
- Inspect web and application logs for unusual plugin-related requests from low-privileged accounts.
Limitations of the available information
The record does not specify the exact vulnerable functionality, the minimum role required beyond low privileges, or a fixed version. No EPSS data is available. Details are based mainly on the Patchstack entry and NVD/CVE records.
Frequently asked questions
Which versions of Woody ad snippets are affected?
All versions up to and including 2.7.1 are affected, according to the CNA record.
Is CVE-2026-25366 being exploited in the wild?
It is not in the CISA KEV catalog and the SSVC assessment lists exploitation as none; no confirmed exploitation appears in the sources consulted.
Does an attacker need an account?
Yes. The CVSS vector indicates low privileges are required, so an authenticated low-privileged user could abuse the flaw.
Is there a fixed version?
The record does not list one. That does not mean no fix exists; check the Patchstack advisory and the plugin's official channel.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.