RCE in Kiranpatil353 Add Custom Page Template
CVE-2025-3491
The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acpt_validate_setting' function. This is due to insufficient sanitization of the 'template_name' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.007 (49.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Kiranpatil353 Add Custom Page Template — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-3491?
- CVE-2025-3491 is a high-severity vulnerability in Kiranpatil353 Add Custom Page Template, classified under Code Injection. CVSS score: 7.2/10. Published 2025-04-26.
- How severe is CVE-2025-3491?
- High severity. CVSS v3 base score is 7.2 out of 10.