The vulnerability arises from an improper control of code generation in the Nelio AB Testing WordPress plugin. An attacker can inject arbitrary code that is evaluated by the application, enabling remote execution of PHP code. This flaw, classified as CWE‑94, gives an attacker full control over the server, potentially compromising confidentiality, integrity, and availability of the site and any data stored on it.

The flaw affects Nelio Software’s Nelio AB Testing plugin for WordPress. Versions from the initial release through 8.2.7, inclusive, are vulnerable. Any WordPress installation using one of these plugin versions is at risk.

The vulnerability scores a CVSS 9.1, indicating a high‑risk remote code execution flaw. EPSS data is not available and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is remote, as the code is injected through the plugin’s interfaces, and exploitation requires the ability to supply malicious input. Because of the severe impact, disabling the plugin or updating to a patched version is strongly recommended.