The vulnerability is an eval code injection in the MarkItUp Preview AJAX Endpoint of MaxSite CMS. The plugin file preview-ajax.php passes user-controlled data directly into PHP's eval function, allowing execution of arbitrary PHP code. If successfully exploited, an attacker could run any PHP code on the web server, leading to full remote code execution and potentially full system takeover. The CVE does not state whether authentication is required to reach the endpoint, so it is unclear if anonymous access is possible.

MaxSite CMS versions up to 109.1 are affected, specifically the editor_markitup plugin within the administration interface. Versions 109.2 and higher include a patch identified by commit 08937a3c5d672a242d68f53e9fccf8a748820ef3 that removes the vulnerable code. Administrators of older installations should update to 109.2 or later to eliminate the flaw.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests that public exploitation is currently considered low probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, but published exploit code exists online. Attackers could reach the vulnerable endpoint remotely if the CMS is accessible over the network. Whether the endpoint protects against unauthorized access is not specified in the CVE; if no authentication is enforced, any user with network access could attempt exploitation.