The Add Custom Codes plugin for WordPress contains an Improper Control of Generation of Code vulnerability that allows an attacker to inject PHP code, thereby executing arbitrary instructions on the hosting server. By exploiting improperly validated input fields exposed by the plugin, a malicious actor can deploy new code, modify existing files, or elevate privileges, potentially compromising the entire WordPress installation and the underlying operating system.

All installations of the SaifuMak Add Custom Codes plugin from the earliest release up to and including version 4.80 are affected. The vulnerability does not depend on additional hardware or platform constraints, meaning every WordPress site that has the vulnerable plugin active is at risk regardless of the server environment.

The CVSS score of 7.5 indicates a high severity level, while the EPSS score of less than 1% denotes a currently low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. The attack vector is remote; the attacker must supply malicious payloads through the plugin’s web interface, but the exact access requirements are not specified. Successful exploitation provides remote code execution and full control over the affected site.