The Advanced Woo Labels plugin for WordPress allows authenticated users with Contributor level access or higher to trigger arbitrary PHP function calls and shell commands by sending a carefully crafted AJAX request with a user-controlled 'callback' parameter. Because the code uses call_user_func_array() without any allowlist or capability verification, an attacker can inject malicious callbacks. This flaw matches CWE-94 (Code Injection via call_user_func_array) and enables remote code execution that can compromise the entire web server, giving the attacker full control over the site and potentially the underlying operating system.

WordPress sites running the Advanced Woo Labels plugin version 2.37 or earlier, developed by mihail-barinov. The vulnerability affects all releases up to and including 2.37, regardless of WordPress core version, and is located in the addon’s AJAX handler used for retrieving option values.

The vulnerability has a CVSS score of 8.8, indicating a high impact, while the EPSS score of less than 1% suggests low current exploitation activity but still warrants precaution. The exploit does not rely on any special network exposure, only requiring internet-accessible AJAX calls, so it is potentially widely accessible to attackers with contributor credentials. It is not listed in the CISA catalog, but the high severity and the nature of remote code execution require prompt remediation.