CVE-2025-30975

Vulnerability

Overview The Add Custom Codes WordPress plugin (versions up to and including 4.80) suffers from a code injection vulnerability due to improper control of code generation. This flaw allows an attacker to inject and execute arbitrary code on the target site.

Exploitation

Details The vulnerability can be exploited remotely without authentication, as the plugin fails to sanitize user-supplied input before using it in code generation. Attackers can craft malicious requests to inject PHP or other executable code, leading to arbitrary code execution.

Impact

Successful exploitation gives an attacker full control over the affected WordPress site, enabling actions such as data theft, website defacement, or further compromise of server resources. Given the widespread use of WordPress, this vulnerability is expected to be targeted in mass-exploit campaigns.

Mitigation

The vendor has released version 5.0 to address this issue. Users are strongly advised to update immediately. For those unable to update, implementing a web application firewall rule (e.g., Patchstack's mitigation rule) can provide temporary protection. No other workarounds are currently available [1].