The vulnerability resides in the bbackup_ajax_handle() function of the Bears Backup WordPress plugin. The function fails to enforce a capability check and directly passes user-supplied data to call_user_func(), enabling an attacker to execute arbitrary PHP code on the host. This flaw allows unauthenticated attackers to install backdoors, create administrative accounts, or perform any privileged operation on the server. The weakness is classified as CWE-94, code injection via a language interpreter.

WordPress sites running the Bears Backup plugin version 2.0.0 or earlier. Sites that use the Alone theme 7.8.4 or older may also be impacted by chaining this flaw with CVE-2025-5394 to automatically install the vulnerable plugin, thereby extending the attack surface.

The CVSS score of 9.8 demonstrates a critical impact, while the EPSS score of less than 1% suggests that the likelihood of public exploitation is currently low; however, the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be via unauthenticated AJAX requests to the plugin's handler. An attacker needs only to exploit the missing capability check and the unsafe function call to achieve remote code execution, granting full control over the affected WordPress installation.