The vulnerability is an improper control of code generation (CWE‑94) that lets an attacker inject and execute arbitrary code through the Nelio AB Testing plugin. Any user who can interact with the plugin’s features could cause the server to run malicious code, potentially compromising confidentiality, integrity, and availability of the entire WordPress site. The problem exists in versions 8.1.8 and earlier, exposing the application to full remote code execution. The risk is high.

Nelio AB Testing plugin by Nelio Software installed on WordPress environments, from the earliest release up through 8.1.8. Both the core plugin and any plugin‑based code that relies on it are affected.

The CVSS base score of 9.1 indicates a critical level of severity. The EPSS value of <1% suggests exploitation is unlikely at this moment, but the presence of a public description and known exploitation potential means attackers could still target it. The vulnerability is not listed in the CISA KEV catalogue, indicating no evidence of active exploitation yet. Attackers would need to interact with plugin‑provided endpoints, most likely via unauthenticated HTTP requests or exploiting existing remote administration privileges. Given the fully remote nature, the risk to exposed sites is substantial, especially those with default or weak authentication configurations.