An improper control of code generation flaw in the WordPress Post/Page Copying Tool (postpage‑import-export‑with‑custom‑fields‑taxonomies) allows an attacker to inject arbitrary PHP code during the export or import process. This code injection leads to remote code execution, compromising the confidentiality, integrity, and availability of affected WordPress sites. The weakness is identified as CWE‑94 and has a CVSS score of 9.9, indicating a critical severity.

The plugin, distributed by wpspin and named Post/Page Copying Tool, is vulnerable in all versions up to and including 2.0.3. Users running any release in this range should consider the site exposed until a patch or mitigation is applied.

The CVSS score of 9.9 reflects the potential for far‑reaching impact, but the EPSS score of less than 1% indicates that exploitation is currently unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack would require an attacker to trigger the import or export functionality—most likely via the administrative interface or a publicly accessible endpoint—to supply malicious payloads. If these endpoints are exposed to unauthenticated or low‑privileged users, the attack surface would increase, making the risk higher.