The WooCommerce Designer Pro plugin contains a flaw that allows a subscriber to trigger remote code execution on a WordPress site. By sending a specially crafted request, an authenticated subscriber can exploit the plugin’s failure to validate or sanitize input before evaluating it as PHP code. This weakness is an instance of improper code evaluation (CWE-94) and directly enables arbitrary code execution on the server, compromising confidentiality, integrity, and availability of the affected website.

The vulnerability affects the JMAPlugins WooCommerce Designer Pro WordPress plugin in all releases 1.9.33 or older. Any site running one of these versions is at risk if a subscriber account exists or can be created.

The flaw carries a CVSS score of 9.9, indicating critical severity. The EPSS score is 0.00736 (≈0.7 %), indicating a low but non‑zero probability of exploitation. Despite not being listed in CISA KEV, the vulnerability remains exploitable via an authenticated subscriber. An attacker who can create or obtain a subscriber account could leverage the flaw to execute arbitrary PHP code on the affected web server.