CVE-2025-3491 is a high-severity vulnerability in the Add custom page template WordPress plugin (versions up to 2.0.1) caused by improper control of code generation (CWE-94). The vulnerability arises from insufficient sanitization of the 'template_name' parameter in the 'acpt_validate_setting' function, enabling authenticated administrators to perform PHP code injection and achieve remote code execution on the server. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated administrator to execute arbitrary PHP code on the web server hosting the vulnerable plugin. This can lead to full compromise of the affected system, including data theft, service disruption, or further lateral movement within the environment. The vulnerability impacts confidentiality, integrity, and availability at a high level.

No official patch or fix is currently available for this vulnerability. Users should restrict administrator access to trusted personnel only and consider disabling or removing the Add custom page template plugin until a vendor-provided fix is released. Monitor the vendor's advisory channels for updates regarding remediation.