The vulnerability allows an attacker to execute arbitrary code on a WordPress site that is running the Blocksy Companion Pro plugin version 2.1.45 or earlier. The flaw is caused by improper handling of user-supplied data that is executed as PHP code, as indicated by the CWE‑94 association with code injection. If exploited, a remote attacker could gain full control of the affected WordPress installation, including the ability to modify files, access sensitive data, or install additional malware.

The affected product is the Blocksy Companion Pro plugin from Creative Themes. Versions 2.1.45 and below are vulnerable. No other products or versions are listed.

The CVSS score of 8.5 indicates a high impact severity. EPSS is not available, so the likelihood of exploitation cannot be quantified from the data; the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote via the web interface, as the plugin processes input from HTTP requests that can be crafted to trigger code execution. No additional prerequisites are described, implying that a remote user who can send a specially crafted request to the affected plugin endpoints may exploit the flaw.