The vulnerability in the Cwicly WordPress plugin permits an attacker to execute arbitrary code on the hosting server. The flaw arises from improper handling of contributor input, allowing malicious code injection into files or modules that are subsequently executed by the server. Consequently, an attacker can gain full control over the compromised site, leading to data theft, defacement, or further attacks against the server infrastructure. This weakness is identified as CWE-94, which denotes a code injection vulnerability.

The affected software is the Cwicly plugin for WordPress, with all versions up to and including 1.4.4. Administrators of WordPress sites who have installed and enabled this plugin are at risk.

The CVSS score of 9.9 marks this issue as Critical, indicating that exploitation would result in complete compromise of confidentiality, integrity, and availability. The EPSS score is not available, so the likelihood of exploitation is unknown, but the severity and lack of mitigation in the vendor’s response mean that attackers can target sites without much difficulty. This vulnerability can be exploited remotely through a WordPress site that allows contributor access; in that scenario, an authenticated contributor could submit malicious payloads that are executed during normal operation. The issue has not been listed in CISA's KEV catalog, but its high severity warrants immediate attention.