The vulnerability exists in the Cart All In One For WooCommerce plugin, where an insufficiently validated input field named 'Assign page' is fed directly into the eval() function. This allows an authenticated user with Administrator-level access to insert arbitrary PHP code that will be executed on the server, compromising the entire site’s confidentiality, integrity, and availability.

The affected product is the Villatheme Cart All In One For WooCommerce WordPress plugin. All releases up to and including version 1.1.21 are impacted.

The CVSS score of 7.2 indicates high severity, though the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability requires administrative privileges (authenticated via standard WordPress login), so an attacker must first compromise or obtain legitimate admin credentials. Once privileged, the attacker can exploit the eval() call to run arbitrary code. The plugin is not listed in the CISA Known Exploited Vulnerabilities catalog, which limits current public exploitation activity.