The Fresh Framework plugin for WordPress has a flaw where user supplied input can be used to control code generation, leading to arbitrary code execution. This weakness, identified as CWE‑94, means an attacker could inject malicious PHP code that the plugin will execute without restriction. The impact is system‑wide compromise of the affected WordPress site, with full control of files, data, and the underlying server.

FRESHFACE Fresh Framework plugin versions up to and including 1.70.0 used in WordPress installations are vulnerable. Any site running the plugin in this version range is at risk. No other products or newer versions are listed as affected.

The CVSS score of 10 indicates a critical severity and the EPSS score of < 1% suggests that actual exploitation might be rare, though the vulnerability is still present. Because the issue allows unauthenticated code injection, an attacker can exploit it simply by sending crafted requests to the plugin’s endpoints without needing any credentials or site access. The CVE is not currently listed in the CISA KEV catalog, but the high severity warrants immediate attention.