A code injection flaw exists in the test connection function of wgcloud version 2.3.7 and earlier. The vulnerability, classified as CWE‑94, allows a remote attacker to supply malicious payloads that are executed by the server, leading to full remote code execution. This can compromise the confidentiality, integrity, and availability of the host system, potentially granting an attacker unrestricted control.

All installations of wgcloud 2.3.7 or earlier, regardless of operating system, are vulnerable. The product is referenced by the CPE entry cpe:2.3:a:wgstart:wgcloud:*:*:*:*:*:*:* and is commonly used in environments that rely on WG Cloud for VPN configuration and management.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. EPSS reports a probability of less than 1 %, suggesting that while exploitation is unlikely, the impact if it occurs would be catastrophic. The issue is not yet part of the CISA KEV catalog. Exploitation requires network access to the test connection endpoint, and the attack vector is remote. No defensive conditions beyond patching are specified in the advisories.