The Sneeit Framework WordPress plugin contains a critical Remote Code Execution flaw in the sneeit_articles_pagination_callback() function. By passing unchecked user input to call_user_func(), an attacker can execute arbitrary PHP code on the web server. This enables the creation of backdoors, the addition of privileged user accounts, and full compromise of server confidentiality, integrity, and availability. The weakness is identified as a code injection vulnerability (CWE-94).

All installations of the Sneeit Framework plugin version 8.3 or earlier are affected. The flaw is present in the plugin itself and not in core WordPress. No specific patched version is listed, but upgrading beyond 8.3 removes the vulnerable callback.

The CVSS score of 9.8 reflects critical severity, and an EPSS score of 76% indicates that exploitation is both possible and relatively likely at this time. The vulnerability is not in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP request to the sneeit_articles_pagination_callback() endpoint containing crafted parameters that are passed directly to call_user_func(). The lack of authentication checks means any visitor could trigger the flaw. Once exploited, the attacker can run arbitrary code, jeopardizing the entire WordPress site and underlying server.