Introduction
Attackers with author-level access can execute arbitrary PHP code on WordPress sites running Advanced Views plugin versions up to and including 3.7.19. The cause is a Server-Side Template Injection (SSTI) flaw in a widely used plugin for dynamic content display and custom fields, and it enables full compromise of affected sites.
About the software: Advanced Views is a WordPress plugin from WPLake that displays posts and custom fields from sources like ACF, MetaBox, Pods, and WooCommerce. Developers like it for its flexibility and its integration with modern templating engines like Twig. A significant number of WordPress sites use it, especially sites that need advanced content presentation.
Technical Information
CVE-2025-10380 is a Server-Side Template Injection vulnerability in the Advanced Views plugin for WordPress, affecting all versions up to and including 3.7.19. It comes from insufficient input sanitization and missing access control when the plugin processes custom Twig templates in the Model panel. Authenticated users with author-level privileges or higher can inject malicious Twig template code, and the server then executes it.
The vulnerable code is in the plugin's src/Template_Engines/Twig.php file, at or around line 106 in version 3.7.19 (reference). Attackers can use crafted Twig templates to execute arbitrary PHP code and system commands. The root cause is improper neutralization of special elements used in the template engine, classified as CWE-1336.
The referenced sources include no public proof of concept or exploit code. Exploitation requires authentication but not administrative privileges, which puts it within reach of more users in a typical WordPress deployment.
Affected Systems and Versions
- Product: Advanced Views – Display Posts, Custom Fields, and More (WordPress plugin)
- Affected versions: All versions up to and including 3.7.19
- Vulnerable configuration: Any WordPress site with the plugin installed and author-level (or higher) authenticated users who can create or edit custom Twig templates in the Model panel
Vendor Security History
WPLake develops Advanced Views, which is widely adopted for advanced content display in WordPress. Previous vulnerabilities in the plugin have not been widely reported, but its integration with powerful template engines like Twig increases its attack surface. WPLake's documentation and update cadence are generally good. This SSTI issue shows the risk of processing user-supplied template code all the same.
