CVE-2008-1059: WordPress Sniplets plugin remote file inclusion via libpath

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with public exploit code and very high EPSS probability makes this an urgent fix despite its age.

What it is

The Sniplets plugin (versions 1.1.2 and 1.2.2) for WordPress contains a remote file inclusion flaw in modules/syntax_highlight.php, where the libpath parameter is used to include a remote file without validation. An attacker can point libpath at a URL hosting malicious PHP, causing the server to fetch and execute it. This matters because it yields remote code execution on the web server with no authentication required.

Impact

An unauthenticated attacker gains arbitrary PHP code execution on the WordPress host, which typically means full compromise of the site and potentially the underlying server. This can lead to data theft, defacement, or use of the host as a pivot point.

Attack surface

Reached over the network via an HTTP request to the plugin's modules/syntax_highlight.php with a crafted libpath parameter; the CVSS vector AV:N/AC:L/Au:N confirms no authentication and no user interaction are needed.

Exploitation

Public exploit code exists (Exploit-DB 5194 and a SecurityFocus BID tagged Exploit), and EPSS is 0.48329 (98.8th percentile), indicating high likelihood of exploitation; it is not listed in CISA KEV.

What to do

• Patch or remove the Sniplets plugin; if no fixed version exists, deactivate and uninstall it, since the plugin is long abandoned.
• Disable allow_url_include and allow_url_fopen in php.ini to block remote file inclusion at the PHP level.
• Restrict outbound HTTP from the web server so it cannot fetch attacker-hosted PHP payloads.
• Audit the WordPress installation for other outdated plugins and enforce a patch management process.
• Deploy a WAF rule blocking requests to modules/syntax_highlight.php with external URLs in libpath.

Detection

• Search web server logs for requests to modules/syntax_highlight.php with libpath containing http:// or https:// URLs.
• Monitor for outbound HTTP connections from the web server to unfamiliar hosts, especially followed by PHP execution.
• Look for unexpected PHP files or recently modified files in the WordPress web root and upload directories.
• Alert on PHP include or require errors referencing remote URLs in application logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.