An insecure sanitization routine in the Easy PHP Settings plugin allows administrators to insert arbitrary PHP code via the wp_memory_limit and wp_max_memory_limit settings, since sanitize_text_field does not strip single quotes. By modifying wp-config.php, valid administrators can break out of a define statement and embed code, giving them the ability to execute code on the server with the file's permissions. This is a classic code injection flaw (CWE-94).

Vulnerable versions are Easy PHP Settings 1.0.4 and earlier. The issue appears in the update_wp_memory_constants() method of the plugin, which is part of the plugin by Shahadul878 for WordPress. WordPress sites running any of those versions are at risk.

CVSS score 7.2 indicates moderate to high severity, and the EPSS score is below 1 percent, suggesting that public exploitation is currently unlikely. Nevertheless, because the flaw requires administrator-level authentication, users should assume that only those with admin access can exploit it directly. The vulnerability is not listed in the KEV catalog, and the risk is primarily the ability to run arbitrary code after logging in, which could lead to full server compromise. Based on the description, it is inferred that the attacker must have administrator privileges in WordPress to modify the plugin's settings. The attack vector is likely through the WordPress administrative interface, where an authenticated administrator can alter the plugin's settings to inject code.