CVE-2017-20251

METADATA
VENDOR_NAME: Themeisle
AFFECTED_VERSION: < 3.3.1
MITRE_TACTIC: T1190 — Exploit Public-Facing Application
SHODAN_DORKS: ["http.component:"wordpress"", "wp-json/wp/v2/posts", "insert_php"]
CWE_ID: N/A
CVSS_VECTOR: N/A
POC_STATUS: None
PATCH_DETAILS: No patch available (UNPATCHED)

Executive Summary

CVE-2017-20251 is a PHP code injection vulnerability in the WordPress Insert PHP plugin (Themeisle) affecting versions before 3.3.1. Unauthenticated attackers can execute arbitrary PHP code by sending crafted POST requests containing malicious insert_php shortcodes to the wp-json/wp/v2/posts REST API endpoint. The flaw enables remote code execution on the server with a CVSS score of 9.3, affecting any WordPress site using the vulnerable plugin version.

Technical Analysis

The vulnerability resides in the Insert PHP plugin’s handling of shortcodes submitted through the WordPress REST API. The plugin registers the insert_php shortcode handler that accepts user-supplied content and processes it without proper sanitization or capability checks. When a POST request reaches the wp-json/wp/v2/posts endpoint with content containing the insert_php shortcode, the plugin evaluates the supplied PHP directive, allowing inclusion and execution of remote or local PHP files. No authentication is required because the REST route for posts accepts unauthenticated submissions in default WordPress configurations when the plugin is active. The attack surface is the public REST API, which bypasses traditional shortcode filtering applied only to the admin interface or authenticated contexts.

Exploitation Scenarios

1. Reconnaissance/target identification: Attackers scan for WordPress sites exposing the wp-json/wp/v2/posts endpoint and confirm presence of the Insert PHP plugin.
2. The specific flaw class is triggered by sending an unauthenticated POST request to wp-json/wp/v2/posts containing a post body with an insert_php shortcode.
3. Payload/execution method at the vulnerability-class level: The shortcode instructs the plugin to include and execute a remote PHP file, causing the server-side PHP interpreter to run attacker-controlled code.
4. Post-exploitation impact: Arbitrary PHP execution grants the attacker the ability to read files, write webshells, or pivot within the hosting environment. No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Successful exploitation results in full remote code execution on the web server, allowing complete compromise of the WordPress installation and underlying host. Affected systems are any WordPress sites running Insert PHP plugin versions before 3.3.1 with the REST API enabled. Blast radius includes data exfiltration, website defacement, installation of persistent backdoors, and lateral movement to connected databases or internal networks. The CVSS score of 9.3 reflects high impact on confidentiality, integrity, and availability with low attack complexity and no required privileges.

Detection Guidance

Sigma Rule

title: WordPress Insert PHP Plugin Code Injection via REST
id: 7f8e2c4a-9b3d-4e1f-8c2a-5d6e7f8a9b0c
status: experimental
description: Detects POST requests to wp-json/wp/v2/posts containing insert_php shortcode
logsource:
  category: webserver
detection:
  selection:
    http.method: POST
    http.uri|contains: 'wp-json/wp/v2/posts'
    http.body|contains: 'insert_php'
  condition: selection
fields:
  - client_ip
  - http.uri
  - http.body

YARA Rule

rule Wordpress_Insert_PHP_RCE_REST {
    meta:
        description = "Detects indicators of CVE-2017-20251 exploitation"
    strings:
        $endpoint = "wp-json/wp/v2/posts"
        $shortcode = "insert_php"
    condition:
        $endpoint and $shortcode
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2017-20251 WordPress Insert PHP RCE attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"wp-json/wp/v2/posts"; http.request_body; content:"insert_php"; classtype:web-application-attack; sid:20251701; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and url.path == "/wp-json/wp/v2/posts" and http.request.body.content like "*insert_php*"]

Splunk SPL Query

index=web sourcetype=access_combined method=POST uri="/wp-json/wp/v2/posts" body="*insert_php*" 
| stats count by src_ip, uri, body

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100501" level="12">
    <if_sid>31100</if_sid>
    <match>POST.*wp-json/wp/v2/posts.*insert_php</match>
    <description>Possible CVE-2017-20251 exploitation attempt</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Block unauthenticated access to /wp-json/wp/v2/posts or disable the REST API if not required; restrict plugin shortcode execution via .htaccess or WAF rules matching insert_php.
2. Patch/upgrade steps: Upgrade the Insert PHP plugin to version 3.3.1 or later; if no official update exists, remove the plugin and replace with an alternative that does not expose code execution via shortcodes.
3. Long-term hardening: Enforce authentication on all REST routes, apply least-privilege file permissions, and regularly audit installed plugins against known vulnerable versions.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-20251
• CNA Title: WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API
• WordPress Plugin Directory (historical)
• No CISA KEV entry; no confirmed threat actor campaigns observed.