CVE-2025-13035: 
WordPress vulnerability analysis and mitigation

CVE-2025-13035 is a PHP Code Injection vulnerability in the Code Snippets plugin for WordPress, affecting all versions up to and including 3.9.1. The flaw allows authenticated attackers with Contributor-level access or above to execute arbitrary PHP code on the server via the [code_snippet] shortcode using PHP filter chains. It was published on November 19, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 8.0 (High) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). Specifically, the plugin's evaluate_shortcode_from_flat_file method calls PHP's extract() function on attacker-controlled shortcode attributes without sanitization, allowing an attacker to overwrite the $filepath variable. This overwritten variable is then passed directly to require_once, enabling PHP filter chain-based code execution. Exploitation requires two preconditions: an administrator must have enabled the "Enable file-based execution" setting, and at least one active Content snippet must exist — meaning the attacker must socially engineer an administrator to configure these settings (Wordfence, ENISA EUVD).

Successful exploitation grants the attacker arbitrary PHP code execution on the web server, resulting in high confidentiality, integrity, and availability impact with a changed scope. An attacker could read sensitive data (credentials, database contents), modify or delete files, install backdoors or web shells, and potentially pivot to other systems on the network. The impact is scoped beyond the plugin itself to the underlying server environment (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.042%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation complexity is rated High due to the requirement for user interaction (tricking an administrator) and specific non-default configuration prerequisites (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Code Snippets plugin version ≤ 3.9.1 using tools like WPScan or Shodan.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Social engineering: Trick an administrator into enabling the "Enable file-based execution" setting in the Code Snippets plugin options and ensuring at least one active Content snippet exists.
4. Craft malicious shortcode: Construct a [code_snippet] shortcode with a specially crafted attribute that, when processed by extract(), overwrites the $filepath variable with a PHP filter chain payload (e.g., php://filter/convert.base64-decode/resource=...).
5. Inject shortcode: Insert the malicious shortcode into a post or page that the attacker can author (Contributor role allows post creation).
6. Trigger execution: When the page is rendered (e.g., by previewing or publishing), the evaluate_shortcode_from_flat_file method processes the shortcode, extract() overwrites $filepath, and require_once loads and executes the attacker's PHP payload, achieving remote code execution (Wordfence).

• Logs: WordPress access logs showing POST or GET requests to pages/posts containing [code_snippet] shortcodes with unusual or encoded attribute values; PHP error logs referencing require_once failures or unexpected file paths including php://filter wrappers.
• File System: Unexpected PHP files or web shells created in the WordPress installation directory or uploads folder; modifications to existing plugin files.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) following page rendering events.
• Network: Outbound connections from the web server to unknown external IPs, particularly following requests to pages with Code Snippets shortcodes.

The Code Snippets plugin released version 3.9.2 to address this vulnerability; administrators should update immediately (Wordfence, Sucuri Blog). As a workaround, administrators should disable the "Enable file-based execution" setting in the Code Snippets plugin options, which removes the vulnerable code path entirely. Additionally, review and restrict Contributor-level user accounts to only trusted individuals, and audit existing Content snippets for any suspicious entries.

Wordfence, the assigning CNA, published the vulnerability details and credited the discovery in their threat intelligence database. Sucuri included CVE-2025-13035 in their November 2025 vulnerability patch roundup, noting the importance of updating the plugin (Sucuri Blog). CISA referenced the vulnerability in their weekly bulletin for the week of November 17, 2025 (CISA Bulletin). Community discussion was limited, reflecting the relatively high exploitation complexity and non-default configuration requirements.