Improper control of code generation (Code Injection) in the PluginUs.Net MDTF wp‑meta‑data‑filter‑and‑taxonomy‑filter plugin up to version 1.3.9 allows an attacker to inject and execute arbitrary PHP code when user input is processed. This flaw can lead to full compromise of a WordPress site, giving the attacker the ability to modify files, steal data, or use the server for further attacks.

Any WordPress site running PluginUs.Net’s MDTF wp‑meta‑data‑filter‑and‑taxonomy‑filter plugin version 1.3.9 or older is affected; the vulnerability is confined to the plugin, not the core WordPress files.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1 % shows a very low but non‑zero probability of exploitation; the CVE is not listed in CISA’s KEV catalog, so no known active exploitation is recorded. Likely attack requires a user‑supplied data path that reaches the plugin’s code generation logic, and the plugin must be active on a reachable WordPress site. Therefore sites running a vulnerable version should consider the vulnerability a realistic risk until the plugin is updated or otherwise mitigated.