The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection that can be exploited by administrators or higher‑privileged users to execute arbitrary PHP code on the web server. This injection flaw, identified as CWE‑94, allows the attacker to compromise confidentiality, integrity, and availability of the affected system by running malicious scripts or system commands. The vulnerability exists in the acpt_validate_setting function where the template_name parameter is not properly sanitized.

WordPress sites that use the Add custom page template plugin (developed by kiranpatil353) in any version up through 2.0.1 are affected. Administrators with high‑level access to the site via the WordPress dashboard can trigger the injection.

The CVSS score of 7.2 indicates a high severity risk, and the EPSS score of 2% shows a relatively low but non‑negligible likelihood that the vulnerability will be exploited in the wild. It is not listed in CISA KEV. Attackers must have Administrator‑level credentials to exploit the flaw, so the attack vector is likely internal or compromised credentials rather than external unauthenticated access. Once an attacker gains code execution, they can compromise the entire WordPress installation and potentially the underlying server.