The Sneeit Framework plugin for WordPress is vulnerable to remote code execution in all releases version 8.3 and older. The vulnerability lies in the sneeit_articles_pagination_callback() function, which accepts user input and forwards it directly to call_user_func(). This evaluation of arbitrary input allows an unauthenticated attacker to execute any PHP code on the host, enabling the installation of backdoors or the creation of new privileged user accounts. The flaw is a classic code injection weakness identified as CWE-94.

All installations of Sneeit Framework WordPress plugin the version 8.3 or earlier are affected. No specific patch version is listed beyond the statement that versions up to and including 8.3 contain the flaw. The vulnerability is present in the plugin, not the core WordPress software.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of 0.01421 (~1.4%) reflects that while exploitation is possible it is not highly probable but still notable. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by sending crafted input to the sneeit_articles_pagination_callback() endpoint without authentication, likely via an HTTP request containing a parameter that is evaluated by call_user_func(). The lack of authentication checks means any visitor could potentially exploit the flaw. Once exploited, the attacker can run arbitrary code, compromising server confidentiality, integrity, and availability.