The flaw is an improper control of code generation in the WordPress Woody ad snippets plug‑in’s insert‑php feature, allowing an attacker to inject and execute arbitrary PHP code. This results in full compromise of the web application, affecting confidentiality, integrity, and availability. The weakness is classified under CWE‑94, Code Injection.

WordPress sites that have the Woody ad snippets plug‑in deployed with versions up to and including 2.7.1 are affected. The vulnerability is limited to installations where the insert‑php capability is enabled.

The CVSS score of 9.9 marks this as a critical vulnerability. EPSS and KEV data are unavailable, but the nature of the flaw suggests a high probability of exploitation in environments where the plug‑in remains active. The likely attack vector is through the insert‑php interface, probably requiring authenticated access to the WordPress admin area. The impact is full remote code execution on the affected host.