The vulnerability arises from the misuse of extract() on shortcode attributes within the evaluate_shortcode_from_flat_file method, allowing an authenticated Contributor‑plus user to overwrite the $filepath variable and subsequently force the plugin to require an attacker‑controlled file. This PHP code injection (CWE‑94) can execute arbitrary server‑side code, enabling the attacker to compromise secrets, install backdoors, or pivot to further attacks.

The affected product is the WordPress Code Snippets plugin, versions up to and including 3.9.1. Sites running these versions with the "Enable file‑based execution" setting enabled and at least one active content snippet are susceptible. No other vendors or products are listed.

The CVSS score of 8 highlights the high impact of code execution for authenticated users, while the EPSS score of less than 1% indicates a low overall likelihood of exploitation. The flaw is not in the CISA KEV catalog. Exploitation requires an authenticated Contributor or higher, the activation of the file‑based execution setting, and an active snippet, limiting the attack surface but remaining a serious risk for exposed WordPress sites.