The MetalpriceAPI WordPress plugin contains an improper control of code generation flaw that permits attackers to inject arbitrary PHP code. An attacker can trigger this through specially crafted input to the plugin’s endpoints, yielding remote code execution on the hosting server. This vulnerability aligns with CWE‑94 and threatens confidentiality, integrity, and availability of the affected system.

The vulnerability affects the MetalpriceAPI plugin for WordPress, versions up through and including 1.1.4. Sites running the old plugin (any version 1.1.4 or earlier) are susceptible.

The CVSS score is 9.9, indicating critical severity. The EPSS score is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely exploit it remotely by sending malicious requests to the plugin’s HTTP API or web forms; this inference is based on typical WordPress plugin behavior. The vulnerability requires web access to the site’s plugin code path, which is generally available to anyone with access to the WordPress installation, making it a high‑risk exposure if the plugin remains unpatched.