CVE-2011-10033CWE-95

WordPress Plugin is-human <= v1.4.2 Eval Injection RCE

Critical · published October 15, 2025

CVSS v4.0
9.3
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

The WordPress plugin is-human <= v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' parameter when the 'action' parameter is set to 'log-reset'. The root cause is unsafe use of eval() on user-controlled input, which can lead to execution of attacker-supplied PHP and OS commands. This may result in arbitrary code execution as the webserver user, site compromise, or data exfiltration. The is-human plugin was made defunct in June 2008 and is no longer available for download. This vulnerability was exploited in the wild in March 2012.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00478 · 40.0th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2025-10-15T01:23Z
EPSS history
Timeline
  • 15 OCT 01:23Z
    WordPress Plugin is-human <= v1.4.2 Eval Injection RCE
    cvelistv5