The vulnerability is an Improper Control of Generation of Code flaw that permits Remote Code Inclusion within the WordPress Post Snippets plugin. It allows an attacker to execute arbitrary code on the web host, compromising confidentiality, integrity, and availability of the affected site. The weakness is identified as CWE‑94, highlighting a code injection issue where user input or plugin configuration can lead to code execution.

The impact reaches users of the WordPress Post Snippets plugin from its earliest release through version 4.0.12. The plugin is maintained by Saad Iqbal and widely adopted across many WordPress installations. Any website that has not upgraded beyond 4.0.12 is susceptible.

The CVSS score of 8.5 places this vulnerability in the high severity range, indicating significant risk when a remote attacker can trigger it. EPSS data is not available, but the potential for remote exploitation is clear. The vulnerability is not yet listed in the CISA KEV catalog, yet the nature of the flaw makes it highly likely to be targeted once a patch becomes known. The most probable attack path involves a remote actor sending a specially crafted request or manipulating plugin data to trigger code execution; this inference is based on the described code injection mechanism.