CVE-2025-3491
CVSS 3.1 Score 7.2 of 10 (high)
Details
Published Apr 26, 2025
Updated: Apr 29, 2025
CWE ID 94
Summary
CVE-2025-3491 is a critical vulnerability affecting the Add custom page template plugin for WordPress. It allows authenticated attackers with Administrator-level access to inject and execute PHP code on the server through insufficient sanitization of the 'template_name' parameter in the 'acpt_validate_setting' function. This vulnerability, present in all versions up to and including 2.0.1, poses a significant risk and requires immediate remediation.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.