The vulnerability allows remote code inclusion via the SiteVault plugin’s input handling. This flaw (CWE‑94) permits attackers to inject arbitrary PHP code that is executed on the underlying server, leading to complete remote code execution. As a result, attackers can run arbitrary commands, exfiltrate data, or modify site functionality, compromising confidentiality, integrity, and availability.

All WordPress sites running Royal Plugins’ SiteVault – Backup, Restore, Migration & Cloning plugin version 1.5.18 or earlier (including 1.5.19 as noted in the description) are affected. The plugin can be present on any publicly accessible WordPress installation.

The excerpt does not explicitly state whether authentication is required, but the ability to inject code via public plugin endpoints suggests that the vulnerability may be used by unauthenticated attackers. The CVSS score of 10 reflects the maximum severity of the flaw. Although the EPSS score is < 1%, the remote nature of the attack vector implies a potentially high likelihood of exploitation in practice. The vulnerability is not yet listed in CISA’s KEV catalog, but the sheer impact and ease of exploitation make it a priority for immediate remediation.