CVE-2025-48140 PUBLISHED

WordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) Vulnerability

Assigner: Patchstack
Reserved: 15.05.2025 Published: 09.06.2025 Updated: 01.04.2026

Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through <= 1.1.4.

Product Status

Vendor	metalpriceapi
Product	MetalpriceAPI
Versions	Default: unaffected affected from 0 to 1.1.4 (incl.)

Credits

ch4r0n | Patchstack Bug Bounty Program finder

References

https://patchstack.com/database/Wordpress/Plugin/metalpriceapi/vulnerability/wordpress-metalpriceapi-1-1-4-remote-code-execution-rce-vulnerability?_s_id=cve

Problem Types

Improper Control of Generation of Code ('Code Injection') CWE

Impacts

Code Injection