Improper Control of Generation of Code, identified as CWE-94, allows an attacker to remotely include and execute arbitrary code within the WordPress Global DNS plugin. The flaw is a classic code‑injection vulnerability that grants a full compromise of the affected WordPress site, creating a threat to confidentiality, integrity, and availability.

The vulnerability affects the Global DNS plugin distributed by thehp. All installations using version 3.1.0 or earlier are vulnerable; any WordPress site that has the plugin at or below that version may be exploited.

The CVSS score of 10 signifies the highest severity for this remote code execution flaw. The EPSS score of less than 1% indicates that exploitation attempts are currently low and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated or low‑privilege HTTP request to the plugin’s interface that triggers the inclusion of malicious code, although the official description does not detail the exact request format. Based on the available information, an attacker would construct a request containing malicious payload that the plugin would execute on the host.