This vulnerability is an improper control of code generation flaw that allows an attacker to inject malicious code into the Builderall Builder for WordPress plugin. Such code injection grants the attacker the ability to execute arbitrary code on the affected WordPress installation, potentially compromising confidentiality, integrity, and availability of the site, as well as allowing broader network compromise if the application runs with elevated privileges.

The affected product is Builderall Builder for WordPress, version 3.0.1 and earlier. Users running any version from the initial release through 3.0.1 are at risk.

The CVSS score of 9.9 classifies this as critical severity. The EPSS score is below 1%, indicating a low but non-zero probability of exploitation in the wild, and it is not included in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote, although the input pathways are not explicitly detailed; it is inferred that an attacker may exploit the vulnerability through manipulated content in the builder interface or via crafted HTTP requests that trigger the flawed code generation logic. Only users who can submit data to the vulnerable components are susceptible, so restricting access can mitigate the risk.