An improper control of code generation flaw (CWE-94) in the DigiWidgets Image Editor plugin allows an attacker to inject and execute arbitrary code on the server. The vulnerability is present in all releases up to version 1.10. This can lead to full compromise of the WordPress site, permitting attackers to modify data, install backdoors, or perform further attacks.

The affected product is the DigiWidgets Image Editor plugin by Kellydiek, with all versions from the first release through version 1.10 susceptible.

The CVSS score of 10 indicates maximal severity, but the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The plugin is widely used in WordPress installations, and the vulnerability can be exploited remotely via web requests targeting the plugin’s image editing functionality. The lack of a CISA KEV listing indicates no known public exploitation, but organizations should remain vigilant and prioritize remediation due to the remote code execution potential.