A code injection vulnerability in the Sayan Datta WP Last Modified Info plugin allows authenticated remote attackers to execute arbitrary code, posing a significant risk to site integrity.

This vulnerability is classified as CWE-94, which is improper control of code generation. An attacker with low-level authenticated access can leverage this flaw to perform remote code inclusion within the WordPress environment.

The ability for an authenticated user to perform remote code inclusion allows for full site compromise, including the potential for data exfiltration, unauthorized modification of content, or complete system takeover. With a CVSS score of 7.4, this vulnerability represents a high risk to business operations, as it grants attackers the ability to execute unauthorized commands on the underlying server.

Immediate Action: Review the official WordPress plugin repository for a patched version of the WP Last Modified Info plugin and apply the update immediately. If no update is available, disable the plugin until a secure version is released.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests, specifically looking for unusual patterns or payloads directed at the plugin directory.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing malicious code patterns or unexpected inputs targeting the plugin's endpoints.

Public Exploit Available: Yes (a published proof-of-concept exists via the Patchstack vulnerability database).

Given the severity of potential remote code execution, organizations must prioritize the remediation of this vulnerability. Administrators should verify their current plugin version and apply available updates immediately, while enforcing strict user privilege management to limit the number of accounts capable of triggering this flaw.