The vulnerability exists in the Custom css‑js‑php WordPress plugin up to version 2.0.7. A user supplied input is incorporated directly into an SQL statement without proper sanitization. The result of the query is then evaluated by PHP's eval() function, enabling an attacker to inject arbitrary SQL that ultimately injects executable PHP code. Because the plugin does not enforce authentication boundaries, anyone on the internet can trigger the flaw. An attacker can run arbitrary PHP code on the web server with the permissions of the web application, leading to complete compromise of the site and potentially the underlying host.

Any WordPress installation that has the Custom css‑js‑php plugin installed and is running version 2.0.7 or older is affected. The plugin name is listed by the CNA as Unknown:Custom css‑js‑php; no other vendor or product names are specified.

Since no EPSS score is available, the exploitation likelihood cannot be quantified. The flaw permits trivial unauthenticated exploitation: sending a crafted request to the plugin’s entry point causes the injected SQL to return code that is executed by eval(), resulting in remote code execution. The lack of authentication checks enables any internet user to trigger the vulnerability.