The vulnerability allows an attacker to execute code remotely via the editor function of the MetaSlider Responsive Slider plugin. This remote code execution flaw can be leveraged to run arbitrary PHP scripts, potentially compromising the entire WordPress site. The weakness is identified as CWE-94, which represents code injection or execution vulnerabilities.

Vendors and products affected include MetaSlider: Responsive Slider by MetaSlider. All installations running version 3.106.0 or earlier of the plugin are vulnerable. The latest safe release is 3.107.0 and later.

The CVSS score of 9.1 reflects a high severity, and although the EPSS score is below 1%, indicating a low probability of widespread exploitation at this time, the impact remains critical. The vulnerability is not listed in CISA KEV. Attackers would likely need access to the WordPress admin editor interface or the ability to inject rogue content into it, which is inferred from the description. Once executed, code could run with the permissions of the web server process.