The vulnerability in the WordPress Insert PHP plugin allows attackers to inject malicious shortcodes via the REST API and execute arbitrary PHP code on the server. By sending a crafted POST request to the wp-json/wp/v2/posts endpoint, an unauthenticated attacker can include external PHP files and run them with the site’s permissions. This is a classic code injection weakness (CWE‑94) that can compromise confidentiality, integrity, and availability of the site.

Themeisle Woody Code Snippets, the WordPress Insert PHP plugin, is affected in all releases before 3.3.1. WordPress sites that have installed this plugin and left the REST API publicly accessible are at risk. The plugin is commonly used as a code execution shortcut for site administrators.

The CVSS score of 9.3 reflects a high‑severity, unauthenticated remote code execution exploit. The EPSS score is not available, but the widespread nature of WordPress and the public REST API endpoint suggests a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale active exploitation at the time of reporting. Attackers can reach the vulnerable endpoint from any network and require no special privileges, making the exploitable risk significant for exposed sites.