This vulnerability is an improper control of generation of code (code injection) that allows an attacker to include arbitrary PHP code in the WordPress Total Poll Lite plugin. The attack can lead to full remote code execution on affected WordPress sites, giving attackers control over the host.

The vulnerability affects the TotalSuite Total Poll Lite plugin for WordPress. It is present in all releases from the earliest available up through version 4.12.0. Sites running this plugin without upgrading are vulnerable.

The CVSS score is 9.9, indicating a high‑severity risk. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Documentation does not specify an authentication requirement, so it is inferred that a remote attacker with network access to the site could exploit the vulnerability by sending specially crafted data to the plugin’s remote code inclusion point, assuming default configuration. Due to the critical nature of code execution, rapid exploitation is plausible.