The vulnerability in the Modal Dialog plugin arises from improper control of code generation, a form of code injection. This flaw enables an attacker to insert and execute arbitrary PHP code on the WordPress site, resulting in full remote code execution. The weakness is identified as CWE-94, indicating a failure to validate or sanitize code-generating input.

Affected systems are WordPress installations using the Modal Dialog plugin created by Yannick Lefebvre. All releases from the earliest available version up to and including 3.5.16 are impacted, as stated by the vendor’s range specification.

The issue carries a high CVSS score of 9.1, indicating critical severity. Although the EPSS score is low (< 1%), the potential for catastrophic compromise makes the risk significant. The vulnerability is not listed in the CISA KEV catalog, and no official workaround has been provided. Based on the description, it is inferred that the attack vector is remote, likely through the plugin’s interface where malicious input can be injected.