The vulnerability exists in the Custom css‑js‑php WordPress plugin up to version 2.0.7. A user supplied input is incorporated directly into an SQL statement without proper sanitization. The result of the query is then evaluated by PHP's eval() function, enabling an attacker to inject arbitrary SQL that ultimately injects executable PHP code. Because the plugin does not enforce authentication boundaries, anyone on the internet can trigger the flaw. An attacker can run arbitrary PHP code on the web server with the permissions of the web application, leading to complete compromise of the site and potentially the underlying host.

Any WordPress installation that has the Custom css‑js‑php plugin installed and is running version 2.0.7 or older is affected. The plugin name is listed by the CNA as Unknown:Custom css‑js‑php; no other vendor or product names are specified.

The EPSS score of 0.00017 (less than 1%) shows a very low, but non‑zero, probability of exploitation in the wild. The flaw permits trivial unauthenticated exploitation: a crafted request to the plugin’s entry point injects SQL that returns code executed by eval(), leading to remote code execution. Because the plugin does not enforce authentication, any internet user can trigger the vulnerability. The vulnerability is not listed in the CISA KEV catalog.