{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Code Snippets",
          "vendor": "codesnippetspro",
          "versions": [
            {
              "lessThanOrEqual": "3.9.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@wordfence.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the plugin\u0027s use of extract() on attacker-controlled shortcode attributes within the `evaluate_shortcode_from_flat_file` method, which can be used to overwrite the `$filepath` variable and subsequently passed to require_once. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server via the `[code_snippet]` shortcode using PHP filter chains granted they can trick an administrator into enabling the \"Enable file-based execution\" setting and creating at least one active Content snippet."
    },
    {
      "lang": "es",
      "value": "El plugin Code Snippets para WordPress es vulnerable a la inyecci\u00f3n de c\u00f3digo PHP en todas las versiones hasta la 3.9.1, inclusive. Esto se debe al uso de \u0027extract()\u0027 por parte del plugin en atributos de shortcode controlados por el atacante dentro del m\u00e9todo \u0027evaluate_shortcode_from_flat_file\u0027, que puede usarse para sobrescribir la variable \u0027$filepath\u0027 y posteriormente pasarla a \u0027require_once\u0027. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, ejecuten c\u00f3digo PHP arbitrario en el servidor a trav\u00e9s del shortcode \u0027[code_snippet]\u0027 utilizando cadenas de filtro PHP, siempre que puedan enga\u00f1ar a un administrador para que habilite la configuraci\u00f3n \u0027Enable file-based execution\u0027 y cree al menos un fragmento de contenido activo."
    }
  ],
  "id": "CVE-2025-13035",
  "lastModified": "2026-10-18T20:10:00.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 6.0,
        "source": "security@wordfence.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-13035",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-11-19T17:20:53.291261Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-11-19T08:15:51.780",
  "references": [
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L295"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L296"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3397635%40code-snippets%2Ftrunk\u0026old=3395415%40code-snippets%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file23"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c7247c-2fc3-46ff-858e-2242b7211476?source=cve"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security@wordfence.com",
      "type": "Secondary"
    }
  ]
}