A code injection vulnerability in the SaifuMak Add Custom Codes plugin, affecting versions up to 4.80, allows an authenticated attacker to execute arbitrary code, posing a significant security risk.

This vulnerability is an instance of CWE-94, specifically Improper Control of Generation of Code. The flaw permits an authenticated user with low privileges to inject and execute arbitrary code within the context of the affected WordPress site.

The ability to inject arbitrary code directly into a web application presents a critical risk of full system compromise. Successful exploitation could lead to unauthorized data exfiltration, modification of site content, or the deployment of persistent backdoors, directly impacting the integrity and availability of the business platform. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent unauthorized administrative control.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate and remove the Add Custom Codes plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server and WordPress audit logs for suspicious activity, particularly requests involving unexpected PHP execution or unauthorized modifications to custom code blocks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common code injection patterns and unauthorized requests to plugin-specific endpoints.

Public Exploit Available: No — there is no evidence of a weaponized exploit, Metasploit module, or public proof-of-concept repository.

Given the severity of potential code execution, organizations using the Add Custom Codes plugin must prioritize the removal or mitigation of this component. Administrators should monitor official vendor channels for the release of a patched version and perform a thorough security audit of their WordPress environment to ensure no unauthorized code has already been introduced.