What is the CVSS score of CVE-2026-25366?

CVE-2026-25366 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-25366?

CVE-2026-25366 presents critical security risk, a code injection vulnerability rated CVSS 9.9.

How to fix or mitigate CVE-2026-25366?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2026-25366

EUVD-2026-15689 CRITICAL

Code Injection (CWE-94)

2026-03-25 Patchstack

PHP Code Injection RCE

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15689

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.9

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.

AnalysisAI

A Code Injection vulnerability exists in the Themeisle Woody ad snippets plugin (insert-php) through version 2.7.1 that allows unauthenticated attackers to execute arbitrary PHP code on affected WordPress installations. The vulnerability stems from improper control of code generation, classified as CWE-94, enabling remote code execution (RCE). Patchstack has documented this issue, and affected installations should be patched immediately as the attack vector appears to be network-accessible with low complexity.

Technical ContextAI

The Woody ad snippets WordPress plugin, identified by CPE cpe:2.3:a:themeisle:woody_ad_snippets:*:*:*:*:*:*:*:*, contains a code injection flaw in its insert-php functionality. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), which describes scenarios where user-controlled input is improperly processed before being executed as code. In the context of a WordPress plugin, this typically means that the plugin's insert-php feature (which allows administrators to embed PHP snippets) does not adequately sanitize, validate, or restrict code generation, potentially allowing attackers to inject arbitrary PHP code. The affected versions range from an undefined baseline through version 2.7.1, suggesting the vulnerability may have existed in all released versions of the plugin.

RemediationAI

Immediately upgrade the Themeisle Woody ad snippets plugin to a patched version newer than 2.7.1 via the WordPress plugin dashboard or through direct vendor channels. Verify the patch availability from Themeisle's official security advisories or the WordPress plugin repository. Until patching is complete, disable the Woody ad snippets plugin entirely by deactivating and removing it from active plugins, or restrict access to WordPress admin panels using IP whitelisting and Web Application Firewall (WAF) rules that block suspicious insert-php requests. Conduct a security audit of all sites that had this plugin active to check for signs of code injection or unauthorized PHP execution in logs and database entries. After patching, validate that no malicious code snippets were injected into the database via the insert-php functionality.