A code injection vulnerability in the Code Engine WordPress plugin allows authenticated attackers to execute arbitrary code, threatening total system integrity.

The plugin suffers from improper control of code generation (CWE-94), commonly referred to as code injection. This flaw permits an authenticated attacker to inject and execute arbitrary PHP code within the WordPress environment.

Given the CVSS score of 9.9, the impact of this vulnerability is critical. Successful exploitation allows for full control over the WordPress application and the server, enabling attackers to steal sensitive data, modify core system files, or distribute malware from the compromised site.

Immediate Action: Update the Code Engine plugin to version 0.3.4 or later immediately.

Proactive Monitoring: Monitor server-side logs for unusual execution patterns or modifications to site configuration files that may indicate an injection attempt.

Compensating Controls: Use a WAF to inspect incoming requests for suspicious PHP patterns and restrict access to plugin administrative settings to trusted users only.

Public Exploit Available: Unknown — no confirmed weaponized exploit or public PoC identified in provided data.

Given the severity of potential remote code execution, patching the plugin is a top priority. Administrators should ensure that the update is applied immediately and review existing code snippets managed by the plugin for unauthorized changes.