WordPress sites running the Marketing Fire Widget Options plugin version 4.1.0 or earlier contain an improper neutralization of special elements in a command execution context. The plugin concatenates user‑controlled data into operating‑system commands without proper sanitization, enabling arbitrary shell command execution. An attacker who can supply input to the widget options is able to run any command on the server, leading to full compromise of the affected site. The weakness is classified as CWE‑77.

Any WordPress installation that has the Marketing Fire Widget Options plugin, from its initial release up to and including version 4.1.0, is affected. Sites using this plugin—regardless of whether the plugin is activated on the front end or only accessed via the WordPress admin—could be compromised if attackers reach the settings page used by the plugin.

The CVSS score of 9.9 places this vulnerability in the “Critical” range. However, the EPSS score is < 1 %, indicating a low probability of widespread exploitation in the short term. Although it is not listed in CISA’s KEV catalog, the high severity and the nature of the flaw—arbitrary OS command injection—mean that an attacker who can interact with the plugin’s input fields could achieve server‑level control. The likely attack vector is via the WordPress admin interface, where the widget options are managed, but the flaw could also be exercised through any public‑facing forms that the plugin adds. Given the potential impact, administrators should treat this as a priority vulnerability.