What the vulnerability does
01Description
The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily.
Explanation of Vulnerability in Simple Terms
02Summary
PHP to Page versions 0.3 and earlier contain a code injection vulnerability. An attacker with low-level privileges can inject and execute arbitrary PHP code on the site, affecting confidentiality, integrity, and availability. The vulnerability requires network access but no user interaction. Update to a version newer than 0.3 immediately.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with the privileges of the web server.
Potential impact on your site
04Site Impact
Complete compromise of site data, functionality, and server resources if an authenticated user exploits this.
Conditions required to exploit
05Prerequisites
Low-level user account on the site; network access to the vulnerable component.
Key dates
06Disclosure timeline
October 30, 2023
CVE published
April 8, 2026
Record updated
