The Inpersttion For Theme plugin for WordPress contains a flaw in the theme_section_shortcode() routine that fails to limit the functions an authenticated user can invoke. The flaw allows a logged‑in Contributor or higher to request any PHP function that the server can call, potentially without parameters, giving full code execution capability on the host. The vulnerability is recorded with a CVSS score of 6.3, indicating moderate severity for the affected platform.

WordPress installations that include the Inpersttion For Theme plugin, versions 1.0 and earlier. The plugin is distributed under the vendor identifier inpersttion:Inpersttion For Theme. Any site running these versions and permitting Contributor‑level accounts is vulnerable.

The CVSS score of 6.3 reflects the potential impact of remote code execution once an attacker gains sufficient privileges. The EPSS score of less than 1% indicates the likelihood of exploitation is very low at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a valid Contributor account or higher on the target WordPress site; attackers do not need to bypass authentication. Once authenticated, the attacker can trigger the flaw by invoking the shortcode, leading to code execution without any supplied parameters.