The vulnerability is an improper control of code generation that permits Remote Code Inclusion. An attacker can inject arbitrary code into the WordPress bidorbuy Store Integrator plugin, leading to full system compromise. This fits the CWE‑94 code generation flaw and would allow an attacker to execute arbitrary commands on the hosting server.

The vulnerable component is the WordPress bidorbuy Store Integrator plugin developed by extremeidea. Versions from the initial release through and including 2.12.0 are affected. The plugin is typically installed on WordPress sites that use the bidorbuy store integration feature.

The CVSS score of 9.1 indicates a high severity rating, and the EPSS score of <1% suggests a very low exploitation probability at present, though the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote, where an attacker submits malicious input via the plugin’s exposed endpoints or configuration interfaces. If the plugin is installed, any user with the ability to manipulate its settings could trigger the code injection, potentially compromising the entire web application and underlying operating system.