CVE-2017-20251

Name of the Vulnerable Software and Affected Versions Insert PHP plugin versions prior to 3.3.1

Description An issue allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the "wp-json/wp/v2/posts" endpoint with crafted content containing insert php shortcodes to include and execute remote PHP files on the server.

Recommendations Update the plugin to version 3.3.1 or later.