The Easy Timer WordPress plugin contains a flaw that allows an authenticated user with Editor or higher privileges to execute arbitrary PHP code on the web server. The flaw originates from insufficient restriction of attributes passed to shortcodes, enabling the attacker to inject code that runs with the permissions of the web server. This weakness is classified as CWE‑94, indicating a code injection vulnerability.

The vulnerability affects the Easy Timer plugin developed by Kleor, in all versions up to and including 4.2.1. WordPress sites that have this plugin installed and have users with Editor or higher roles are at risk.

The CVSS score of 7.2 indicates a high severity, while the EPSS score of <1% suggests the likelihood of exploitation is low as of now. The vulnerability is not listed in CISA KEV, meaning it has not yet been observed in the wild. Attackers must be authenticated, possess Editor+ access, and craft a malicious shortcode to trigger the flaw. Once triggered, they can run arbitrary PHP code, potentially compromising the entire WordPress installation and the underlying server.