The vulnerability is an Editor Remote Code Execution flaw found in the WordPress Tabs plugin versions 2.5 and earlier. It allows an attacker who can interact with the plugin’s editor interface to inject arbitrary code that is executed on the server with the web‑server’s privileges. This flaw is a classic code‑injection weakness (CWE‑94) and results in complete compromise of confidentiality, integrity and availability of the affected WordPress site.

The flaw affects the wpshopmart Tabs plugin for WordPress, versions 2.5 and prior. Any WordPress installation that has the plugin installed and has not applied the vendor’s corrective update is vulnerable. The description does not list further prerequisites, but an attacker needs authenticated access to the plugin editor.

The vulnerability carries a CVSS score of 8, indicating high severity. The EPSS score is 0.00384 (0.384%) and the issue is not yet listed in the CISA KEV catalog. The likely attack vector is remote; an attacker could exploit the editor interface if it is accessible to privileged users or, if misconfigured, to lesser users. Given the high severity and the potential for arbitrary code execution, site administrators should treat this as an urgent threat.