The vulnerability is an instance of improper code generation allowing attackers to inject arbitrary code into the WordPress environment. Code injected through the affected plugin can execute with the same privileges as the web server, compromising confidentiality, integrity, and availability of the site. The weakness is categorized as CWE‑94, demonstrating a failure to control the generation of executable code.

Any WordPress installation that has the acowebs Dynamic Pricing With Discount Rules for WooCommerce plugin version 4.5.9 or earlier is impacted. The plugin sits on all sites that use WooCommerce and the dynamic pricing feature, giving attackers a broad potential target surface.

The CVSS score of 9.1 reflects a critical severity with high potential impact. The EPSS score of less than 1 percent indicates a low current likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to involve crafted requests that trigger the code generation routine, allowing an attacker to inject code without requiring additional privileges. The risk remains significant due to the severe impact if exploited.