The vulnerability is an improper control of code generation that allows an attacker to inject PHP code into a WordPress site through the YayCurrency plugin. The injected code can run with the privileges of the web application, giving the attacker full control over the website’s confidentiality, integrity, and availability. The weakness is identified as CWE‑94, indicating that input data is improperly passed to a code execution routine without adequate validation. This flaw can potentially result in arbitrary code execution and takeover of the compromised WordPress installation.

WordPress sites that have the YayCommerce YayCurrency plugin installed with a version equal to or earlier than 3.3.1 are affected. The plugin is distributed by YayCommerce and is used for managing currency functionality within WordPress. Any site running a vulnerable version could be exposed to exploitation through inputs processed by the plugin.

The CVSS base score of 6.6 classifies the vulnerability as medium severity. The EPSS score is reported as less than 1%, indicating a very low probability of widespread exploitation as of the latest data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is a remote scenario where an attacker submits crafted data that is executed by the plugin, potentially via forms or API endpoints. Successful exploitation would require the attacker to deliver the malicious input to the plugin’s code execution path, which currently lacks proper sanitization.