Unauthenticated Remote Code Execution is possible in versions of the SiteSkite plugin up to 2.1.8. The flaw allows an attacker to inject and execute arbitrary code on the host, compromising confidentiality, integrity, and availability of the affected WordPress site. The underlying weakness is a code injection flaw, identified as CWE-94.

The Vendor’s SiteSkite plugin for WordPress, versions up to and including 2.1.8, is affected. Any WordPress installation running one of these plugin versions is at risk.

With a CVSS score of 10, this vulnerability is rated Critical. No EPSS score is published, so the exact likelihood of exploitation is unknown, but the nature of the flaw—unauthenticated remote code execution—means that any user able to access the vulnerable site could potentially exploit it. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits have been documented yet. The attack vector is inferred to be a web‑based remote request to the vulnerable plugin’s entry points, requiring no authentication.