Add Custom Page Template WordPress Plugin PHP Code Injection Vulnerability Allowing Remote Code Execution

A vulnerability allowing PHP code injection has been identified in the Add Custom Page Template plugin for WordPress, in all versions through 2.0.1. This vulnerability arises from inadequate sanitization of the 'template_name' parameter in the 'acpt_validate_setting' function. As a result, authenticated attackers with Administrator-level access can execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for authenticated users with Administrator privileges to execute arbitrary PHP code on the server, potentially leading to full site compromise.