The vulnerability is a Cross‑Site Request Forgery (CSRF) flaw that permits an attacker to inject arbitrary code into the WordPress WP e‑Commerce Style Email plugin. An attacker can cause the plugin to execute unsanitized input, leading to full Remote Code Execution. This weakness is identified as CWE‑352 and can compromise the confidentiality, integrity, and availability of the affected WordPress site.

The flaw affects the Jacob Schwartz WP e‑Commerce Style Email plugin, versions from earliest releases through 0.6.2. Users running any of these versions on a WordPress site are vulnerable; no specific operating system or PHP version is listed.

The CVSS score of 9.6 indicates high severity, while the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not currently listed in CISA KEV. The likely attack vector is CSRF, meaning a malicious attacker would need to entice a user with sufficient privileges (e.g., site administrator) to perform a forged request. Once triggered, the compromised code execution grants an attacker full control over the affected WordPress installation.