The vulnerability is an instance of Improper Control of Generation of Code, also known as Code Injection. It allows an attacker to inject and execute arbitrary code within the WordPress environment. The primary impact is remote code execution, enabling an attacker to compromise the affected server, exfiltrate data, or use the site as a launching pad for further attacks. This weakness is classified as CWE‑94.

The flaw exists in the Real Estate Manager plugin developed by Rameez Iqbal. Any installation of the plugin from the earliest release up through version 7.3 is affected. The vulnerability description does not specify any other product or vendor, so only the plugin itself is impacted.

The CVSS score of 7.3 indicates a high severity level, and the EPSS score of less than 1% suggests a very low probability of commercial exploitation at present. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, possibly through crafted HTTP requests processed by the plugin. Successful exploitation would depend on the plugin’s code execution path being accessible from the web interface, but the exact prerequisites are not detailed in the advisory.