The vulnerability is an Improper Control of Generation of Code flaw that allows an attacker to remotely include arbitrary code within the FunnelFormsPro plugin. Because the plugin can process user input without adequate sanitization, an attacker can inject code that will be executed by the server. This provides an attacker with the potential to compromise the entire hosting environment, exfiltrate confidential data, or establish persistence, representing a critical confidentiality, integrity, and availability impact.

Funnelforms LLC’s FunnelFormsPro plugin for WordPress, all versions from the earliest release through 3.8.1, is affected. The plugin is typically installed in WordPress sites that rely on funnel or form functionalities.

With a CVSS score of 9.9, the technical severity is extremely high. The EPSS score of less than 1% indicates that, at the time of assessment, the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation. However, the remote nature of the flaw means that any WordPress site running an affected version is susceptible if an attacker can supply crafted input; this inference is based on the plugin’s exposure via HTTP requests. The threat remains high due to the potential for total compromise, and the risk persists until a patch or mitigation is applied.