The Code Engine plugin for WordPress includes a shortcode that permits arbitrary PHP code to be executed when used. The plugin does not enforce role restrictions on this functionality, so an authenticated user with Contributor or higher privileges can supply and run malicious code on the server. The stated effect is that remote code execution is possible; no explicit coverage of confidentiality, integrity, or availability is given in the CVE description. Based on the fact that arbitrary code execution is possible on the server, it is inferred that the attacker could read sensitive files, alter site content, or disrupt site operations.

WordPress installations using the Code Engine plugin version 0.3.5 or earlier, distributed by tigroumeow, are affected. The plugin can be obtained from the WordPress Plugin Repository.

The CVSS score of 8.8 indicates a high severity assessment. The EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Contributor or higher user, with the attacker needing to inject code through the 'code-engine' shortcode. Once the shortcode is processed, the injected PHP code runs under the privilege of the web server, providing the attacker with full control of the hosting environment.