The Block Logic – Full Gutenberg Block Display Control plugin is vulnerable because the block_logic_check_logic function evaluates user-supplied input with PHP's eval. This flaw is a classic code injection (CWE-94) that allows an attacker with Contributor or higher privileges to run arbitrary PHP code on the WordPress server. The impact is severe, including full compromise of confidentiality, integrity, and availability of the affected site.

Affected systems are WordPress sites using the Landwire Block Logic – Full Block Display Control plugin, versions up to and including 1.0.8. The vulnerability is present only in these versions; newer releases beyond 1.0.8 are not listed as vulnerable.

The CVSS score of 8.8 categorizes this issue as high severity. With an EPSS score of 1%, attackers are at a non‑zero but relatively low chance of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. The attack requires the attacker to be authenticated as a Contributor or higher, which is a realistic scenario for many sites. Once exploited, the attacker can execute arbitrary code, leading to full site compromise.