The Inpersttion For Theme plugin contains an improper control of code generation vulnerability (CWE‑94) that allows an attacker to inject arbitrary code. This flaw permits the attacker to execute arbitrary PHP scripts within the WordPress context, leading to full site compromise, data exfiltration, and service disruption. The vulnerability resides in the plugin’s handling of user input, enabling direct manipulation of code that is subsequently executed by the server.

The vulnerability affects all versions of the Inpersttion For Theme plugin up to and including version 1.0. Installing or running any of those versions on a WordPress site exposes the site to code injection attacks. The issue is specific to the plugin and does not affect core WordPress or other plugins.

The CVSS score of 7.7 indicates a high severity risk, but the EPSS score of less than 1% implies that the likelihood of exploitation is low at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the most plausible attack vector involves a malicious user submitting crafted input to the plugin’s interface, which the plugin processes and then evaluates as executable code on the server. Thus, an attacker could potentially gain full control over the affected WordPress installation.